Detecting distributed computer network attacks: A multi-dimensional wavelet approach

A technique for anomaly-based detection of distributed attacks is presented. It relies on defining attacks as mathematical singularities in a set of monitored metrics. The decay of wavelet maxima moduli across scales is the basic decision criterion. The most important advantage of this method is that it differentiates between anomalies and attacks, which enhances the false alarm rate. An example, describing a real attack, illustrates the efficiency of the approach.