Detection of abnormal spikes in network traffic using multifractal analysis

Abstract

Recent advances in ubiquitous broadband access networks have engendered an increase in research activities in the area of network teletraffic. We present in this paper the use of wavelet-transform modulus-maxima method (WTMM) for calculating statistical sum, which is more accurate in discovering the singularity of a signal. Data sets made available by the Lincoln Laboratory of MIT (1999 DARPA Intrusion Detection Evaluation) were analyzed as the test sequence. Analysis of the presented dependencies showed that the differences between two sets are manifested in their multifractal spectra, constructed using software based on WTMM method that was developed in the course of this work. These differences exist regardless of the amount of levels of scaling decomposition involved in the analysis. The values of boundary parameters of the spectra αmin and αmax are almost always different for two realizations and can likewise serve as a reliable distinguishing characteristic of multifractal spectra and hence as indicators of the presence of abnormal teletraffic activity.