Traffic Anomaly Detection Using Time Series Decomposition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting traffic anomalies in network traffic data using statistical algorithms based on data distribution are not effective due to the non-normal distribution of network traffic data in short time frames, resulting in low accuracy.
Innovation Solution
A traffic anomaly detection method that involves obtaining a target time series, decomposing it into trend, periodic, and residual components, and then using a decision model corresponding to the identified type based on periodic and jitter density parameters to detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical algorithms based on normal distribution assumption are used for anomaly detection, then the detection process is simple, but the accuracy is low because network traffic data does not follow normal distribution
Solution Approach 1:
The patent segments network traffic data into multiple time windows with different lengths, where each window is further divided into multiple intervals. This segmentation allows the system to capture traffic patterns at different granularities and apply appropriate statistical methods to each segment, improving detection accuracy while managing complexity through structured processing
Solution Approach 2:
The patent changes the parameter of time window length from fixed to variable, adapting the window size based on traffic characteristics. It also introduces multiple statistical parameters (mean, standard deviation, skewness, kurtosis) to describe traffic distribution, allowing the system to flexibly adjust to different traffic patterns and improve anomaly detection accuracy
2Adaptability or versatility
If fixed time window size is used for traffic analysis, then the processing is straightforward, but it cannot adapt to varying traffic patterns and reduces detection accuracy
Solution Approach 1:
The patent implements dynamic time window sizing where the window length adjusts based on traffic characteristics and anomaly detection needs. The system divides windows into multiple intervals with potentially different analysis parameters, allowing adaptive processing that responds to changing traffic patterns while maintaining structured control over the increased complexity
3Measurement precision
If manual analysis methods are used for anomaly detection, then the process is simple to implement, but it cannot overcome the difficulty of detecting anomalies in complex computing systems
Solution Approach 1:
The patent implements feedback mechanisms where anomaly detection results from one time window inform the analysis of subsequent windows. The system uses statistical parameters calculated from historical traffic data to establish baselines and compare against current traffic, automatically adjusting detection thresholds based on observed patterns, thereby enabling sophisticated automated detection without requiring manual intervention
Data Source
AI summary
A traffic anomaly detection method includes obtaining a target time series including N elements; obtaining a target parameter of the target time series, where the target parameter includes at least one of a periodic factor or a jitter density, the periodic factor represents a wave-shaped change that is presented in the target time series and that is about a long-term trend, and the jitter density represents a deviation between an actual value and a target value of the target time series within a target time; determining, from a plurality of types based on the target parameter, a first type to which the target time series belongs, where each of the types corresponds to one parameter set, and the target parameter belongs to a parameter set corresponding to the first type; and detecting an anomaly of the target time series based on a first-type decision model corresponding to the first type.