Anomaly detection in communication networks using wavelets

Abstract

An algorithm is proposed for network anomaly detection based on the undecimated discrete wavelet transform and Bayesian analysis. The proposed algorithm checks the wavelet coefficients across resolution levels, and locates smooth and abrupt changes in variance and frequency in the given time series, by using the wavelet coefficients at these levels. The unknown variance of the wavelet coefficients is considered as a stochastic nuisance parameter. Marginalisation is then used to remove this nuisance parameter by using three different priors: flat, Jeffreys' and the inverse Wishart distribution (scalar case). The different versions of the proposed algorithm are evaluated using synthetic data, and compared with autoregressive models and thresholding techniques. The proposed algorithm is applied to monitor events in a Dial Internet Protocol service. The results show that the proposed algorithm is able to identify the presence of abnormal network behaviours in advance of reported network anomalies.