MODIFICATION OF METHODOLOGY OF WAVELET-ANALYSIS IS FOR EXPOSURE OF ANOMALIES IN TRAFFIC OF COMPUTER NETWORK
Urgency of the research. Reliable data transmission in the network should be based on the usage of appropriate methods of anomaly detection network traffic. Quantitative analysis of the network on the basis of a statistical approach is based on the data analysis in the form of dynamic series. Methodological support improvement of computer network traffic analysis is necessary for effective usage of wavelet analysis methods. Target setting. Methods of wavelet analysis is prospective for detection of network traffic abnormal behavior because they are based on the decomposition of traffic as dynamic series of. In this case there are set of problems such as appropriate scalable wavelet functions selecting, ways of detail coefficients determining, its interpretation and hypotheses testing for the traffic behavior anomaly. Actual scientific researches and issues analysis. Works which were devoted to statistical methods and techniques for analysis and anomaly detection algorithms include evaluation of anomalous traffic indicators such as: the first kind of errors, errors of the second kind, the number of correctly identified anomalies.. Uninvestigated parts of general matters defining. Usage wavelet analysis algorithms is associated with its specific resource consumption and complexity, the difficulties of the second kind errors detecting. In addition, there is the question of choice of the most appropriate scaling function and necessity of interpretation of approximating and detailing factors, which are formed a separate statistical sample. The research objective. The aim is the usage Fourier series as the scaling function in the traffic wavelet analysis; construction of idealized network profile and evaluation of anomalous traffic behavior; coefficient detailing analysis as a separate statistical sample. The statement of basic materials. Traffic analysis using Fourier functions as scaling was conducted. This provided the possibility to get an amplitude in an explicit form and initial phases of harmonic component. This made it possible to compare the "ideal profile" with real traffic. Preliminary conclusions about the presence of anomalies on areas where there is an exceeding of simulated traffic over the real are conducted. Sharp change of the absolute value of detailing coefficients in the analyzed traffic windows can also be interpreted as anomaly traffic. Conclusions. The proposed Wavelet analysis method modification provides a significant reduction of analysis capacity resources of network traffic. Usage of Fourier series allows to identify trends and cyclical components in traffic, identify anomalous zones. Obtained approximating and detailing coefficients can be used as anomalous traffic characteristics in the analysis of its changes.