Network Traffic Analysis Using Time-Frequency Representations

This paper presents some results obtained with time-frequency representations used to identify and analyze network traffic anomalies. The detected anomalies were represented by an increase in certain type of network traffic that was captured using a network sniffer. Counting the broadcast and multicast packets that are transmitted in a network over time a packet count signal can be obtained in the form of a time series. This signal is then processed using time frequency representations (TFRs). TFRs are well suited to detect non-stationary events in a signal, which is exactly what the sudden increase in multicast and broadcast packets due to a misconfigured device or a malfunction is. Using methods like the Short-Time Fourier Transform (STFT), or other time-frequency distributions, time-localized increases in signal energy at certain frequencies can be detected and network functionality can be restored. The results presented in the paper show that this method can be used to obtain valuable frequency and spatial information from the signal that can be further processed using more advanced methods.