Application of wavelet packet transform to network anomaly detection

Abstract

In the last few years, the number and impact of security attacks over the Internet have been continuously increasing. Since it seems impossible to guarantee complete protection to a system by means of the "classical" prevention mechanisms, the use of Intrusion Detection Systems (IDSs) has emerged as a key element in network security. In this paper we address the problem considering different methods, based on the Wavelet Packet Transform, for detecting anomalies in the network traffic, taking into account both the best basis and the value of transformed coefficients. The performance comparison among the different solutions shows that very little information about network anomalies is carried by the best basis selection, while the "distance" between the transformed coefficients leads to very interesting results, highlighting the effectiveness of the proposed approaches. © 2008 Springer-Verlag Berlin Heidelberg.