Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a drift-aware framework for wavelet denoising tailored for network traffic anomaly detection, addressing the limitations of static wavelet methods under non-stationary conditions. By optimizing adaptive wavelet denoising for both anomaly detection and capacity estimation, the approach effectively recovers transient load bursts obscured by noise and statistical drift. The framework employs a four-detector gate to trigger a learned policy that selects optimal wavelet configurations, resulting in improved detection accuracy compared to traditional denoising methods.
Anomaly detection in network traffic can be significantly enhanced by a drift-aware wavelet denoising approach that adapts to changing signal conditions.
Traffic-utilisation measurements for network monitoring are corrupted by additive noise and statistical drift: time-dependent change in the signal's mean, variance, distributional shape, or tail behaviour. Static wavelet denoising, calibrated under stationary independent and identically distributed (i.i.d.) Gaussian assumptions, becomes mismatched under drift and, at moderate-to-high signal-to-noise ratio (SNR), over-suppresses useful structure and degrades monitoring decisions. We propose a drift-aware framework treating adaptive wavelet denoising as a preprocessing layer optimised for two tasks: anomaly detection, recovering the multi-scale transient load bursts that noise and drift obscure, and capacity estimation, recovering the operational required capacity $C_{95}$ (95th percentile of utilisation). Because localised bursts are multi-scale structure a wavelet preserves but a low-pass filter removes, detection discriminates denoiser families. A four-detector gate (Page-Hinkley, variance-ratio, Jensen-Shannon, Anderson-Darling) determines when to invoke a learned policy, and a Proximal Policy Optimization agent selects a per-window wavelet configuration over a mixed discrete-continuous action space. Unlike prior work, the reward is downstream task utility, not reconstruction fidelity. The denoiser is benchmarked, per drift type and input SNR, against a low-pass moving-average filter, VisuShrink, SureShrink, BayesShrink, and a Wiener filter. Defining the anomaly target on the clean signal and the drift gate on the corruption keeps both stages non-circular.