A Hybrid Technique Using PCA and Wavelets in Network Traffic Anomaly Detection

View Sample PDF

Author(s): Stevan Novakov (Carleton University, Canada), Chung-Horng Lung (Carleton University, Canada), Ioannis Lambadaris (Carleton University, Canada)and Nabil Seddigh (Solana Networks, Canada)
Copyright: 2015
Pages: 29
Source title: Research Methods: Concepts, Methodologies, Tools, and Applications
Source Author(s)/Editor(s): Information Resources Management Association (USA)
DOI: 10.4018/978-1-4666-7456-1.ch034

Keywords: Information Science Reference / Library & Information Science / Research Methods

Purchase

View A Hybrid Technique Using PCA and Wavelets in Network Traffic Anomaly Detection on the publisher's website for pricing and purchasing information.

Abstract

Research into network anomaly detection has become crucial as a result of a significant increase in the number of computer attacks. Many approaches in network anomaly detection have been reported in the literature, but data or solutions typically are not freely available. Recently, a labeled network traffic flow dataset, Kyoto2006+, has been created and is publicly available. Most existing approaches using Kyoto2006+ for network anomaly detection apply various clustering techniques. This paper leverages existing well known statistical analysis and spectral analysis techniques for network anomaly detection. The first popular approach is a statistical analysis technique called Principal Component Analysis (PCA). PCA describes data in a new dimension to unlock otherwise hidden characteristics. The other well known spectral analysis technique is Haar Wavelet filtering analysis. It measures the amount and magnitude of abrupt changes in data. Both approaches have strengths and limitations. In response, this paper proposes a Hybrid PCA–Haar Wavelet Analysis. The hybrid approach first applies PCA to describe the data and then Haar Wavelet filtering for analysis. Based on prototyping and measurement, an investigation of the Hybrid PCA–Haar Wavelet Analysis technique is performed using the Kyoto2006+ dataset. The authors consider a number of parameters and present experimental results to demonstrate the effectiveness of the hybrid approach as compared to the two algorithms individually.

The IRMA Community

Research IRM

A Hybrid Technique Using PCA and Wavelets in Network Traffic Anomaly Detection

Purchase

Abstract

Related Content

IRMA Sponsors