Network traffic anomaly detection using weighted self-similarity based on EMD

Network traffic anomaly detection is an important part in network security. Identifying abnormal activities in a timely manner has been a demand in network anomaly detection. Conventional detection methods include Hurst parameter method, wavelet transform and Markov model. This article proposes a new method using weighted self-similarity parameter to detect abnormal activities over the internet. By performing a real-time Empirical Mode Decomposition (EMD) on the network traffic, we calculate the weighted self-similarity parameter based on the first Intrinsic Mode Function to analyze and detect suspicious activities. This approach provides the benefits of faster and accurate detection, as well as low computational cost.