Designing an Internet Traffic Predictive Model by Applying a Signal Processing Method

Abstract

Detection of abnormal internet traffic has become a significant area of research in network security. Due to its importance, many predictive models are designed by utilizing machine learning algorithms. The models are well designed to show high performances in detecting abnormal internet traffic behaviors. However, they may not guarantee reliable detection performances for new incoming abnormal internet traffic because they are designed using raw features from imbalanced internet traffic data. Since internet traffic is non-stationary time-series data, it is difficult to identify abnormal internet traffic with the raw features. In this study, we propose a new approach to detecting abnormal internet traffic. Our approach begins with extracting hidden, but important, features by utilizing discrete wavelet transformation. Then, statistical analysis is performed to filter out irrelevant and less important features. Only statistically significant features are used to design a reliable predictive model with logistic regression. A comparative analysis is conducted to determine the importance of our approach by measuring accuracy, sensitivity, and the Area Under the receiver operating characteristic Curve. From the analysis, we found that our model detects abnormal internet traffic successfully with high accuracy.

A survey of cloud-based network intrusion detection analysis

“…Moreover, the lack of incremental clustering ability is considered as a possible research challenge [57]. Therefore, feature extraction or reduction algorithms often have to be performed, which could provide considerable overhead and slower response to newer, more sophisticated attacks [66].…”

DWT in P4: Periodicity Detection in the Data Plane

“…Performance use cases (1)(2) capture the RTT of packets in benign traffic over a normal link and a congested link, respectively. The security use cases (3)(4)(5) consist of different attacks that generate malicious traffic such as Heartbleed and Cobalt strike. We analyze each use case's traffic separately.…”

“…behavior [3], [10], reconstructing the signal of a network communication [11], and analyzing the energy spectrum [12]. However, traditional signal processing techniques such as the Discrete Fourier Transform (DFT) are known to have a high computational overhead that prevents them from being used for real-time periodicity detection in high throughput scenarios [2], [10].…”

“…In contrast, the Discrete Wavelet Transform (DWT) method can be used to analyze time-series data with low computational overhead by leveraging their intrinsic ability for timefrequency localization, i.e., dividing the data into different frequency components and analyzing each component with a resolution matched to its scale. Used in prior works [3]- [5], [13] to analyze networking traffic data, the DWT method is an especially promising technique for analyzing streaming data where the "signal" is given in the form of packet-level network traces. Not only does it allow for the simultaneous analysis of the signal at different scales, but the method can be naturally parallelized and performed at line rate to enable real-time signal analysis.…”

“…The original DWT method was proposed alongside a simple set of wavelet filters known as the Haar wavelet [13]. Here, we also use the Haar wavelet and leave the application of other wavelets filters such as the Daubechies wavelets [3] for future work. We define the Haar wavelet low-pass and high-pass filters as…”