A Traffic Anomaly Detection Method based on Multi-scale Decomposition and Multi-Channel Detector

Abstract

This paper proposes a new multi-channel network traffic anomaly detection method combined with the idea of multi-scale decomposition and multi-channel detection theory. It can be learned that anomalies could change the characteristics of traffic data at different scales. Traditional anomaly detection methods usually work on each scale independently thus mainly focused on temporally correlated traffic. With the fully exploration on internal frequency-time correlations within multiple scales, this method first obtained the multi-scale decomposition of original traffic data using Ensemble Empirical Mode Decomposition (EEMD), then it is combined with a multi-channel Generalized Likelihood Ratio Test (GLRT) detector, for anomaly detection and decision-making. It can be verified with experiments that this method performs better than other traditional methods, thus gives a new sight on the anomaly detection with different types of traffic data.