A Novel Network Traffic Anomaly Detection Model Based on Superstatistics Theory

With the development of network technology and growing enlargement of network size, the network structure is becoming more and more complicated. Mutual interactions of different network equipment, topology configurations, transmission protocols and cooperation and competition among the network users inevitably cause the network traffic flow which is controlled by several driving factors to appear non-stationary and complicated behavior. Because of its non-stationary property it can not easily use traditional way to analyze the complicated network traffic. A new detection method of non-stationary network traffic based on superstatistics theory is discussed in the paper. According to the superstatistics theory, the complex dynamic system may have a large fluctuation of intensive quantities on large time scales which cause the system to behave as non-stationary which is also the characteristic of network traffic. This new idea provides us a novel method to partition the non-stationary traffic time series into small stationary segments which can be modeled by discrete Generalized Pareto(GP) distribution. Different segments follow GP distribution with different distribution parameters which are named slow parameters. We use this slow parameters of the segments as a key determinant factor of the system to describe the network characteristic and analyze the slow parameters with time series theory to detect network anomaly. The result of experiments indicates that this method can be effective.