=Paper=
{{Paper
|id=Vol-3688/paper27
|storemode=property
|title=Enhancing Network Security Through Wavelet Analysis
|pdfUrl=https://ceur-ws.org/Vol-3688/paper27.pdf
|volume=Vol-3688
|authors=Anatoliy Sachenko,Jacek Woloszyn,Serhii Rimashevskyi
|dblpUrl=https://dblp.org/rec/conf/colins/SachenkoWR24
}}
==Enhancing Network Security Through Wavelet Analysis==
https://ceur-ws.org/Vol-3688/paper27.pdf
Enhancing Network Security Through Wavelet Analysis
Anatoliy Sachenko1,2, Jacek Woloszyn1, Serhii Rimashevskyi2
1
Kazimierz Pulaski University of Technology and Humanities in Radom, Jacek Malczewski str., 29, Radom
2
West Ukrainian National University, L'vivs'ka St, 11, Ternopil, 46009, Ukraine
Abstract
The paper proposes an approach for enhancing network security through the integration of wavelet
analysis. The experiment conducted evaluates the effectiveness of the proposed methodology in identifying
network attack anomalies in real-time. Leveraging Haar's wavelet transform techniques, the methodology
demonstrates high accuracy, low false positive rates, and rapid response times in detecting and mitigating
network threats. The findings highlight the potential of interdisciplinary approaches in addressing
complex cybersecurity challenges and offer valuable insights for securing Internet of Things (IoT) systems.
This research contributes to the ongoing efforts to strengthen network defenses and safeguard critical
infrastructures against evolving cyber threats. Moving forward, future research will focus on refining the
methodology for IoT environments and advancing network security strategies in the digital age.
Keywords
Network security, wavelet analysis, real-time threat detection, Haar's wavelet transform, interdisciplinary
approach, Internet of Things security, cybersecurity, anomaly detection 1
1. Introduction
In the rapidly evolving landscape of digital connectivity, network security stands as a paramount
concern. The proliferation of interconnected devices and the increasing sophistication of cyber
threats necessitate innovative approaches for identifying and mitigating potential risks. Traditional
methods of network security [14-17] rely heavily on reactive measures, often failing to detect subtle
anomalies or emerging attack patterns until significant damage has already been inflicted. To
address this challenge, researchers are leveraging the transformative potential of wavelet analysis to
analyze network attack anomalies in real-time.
A goal of the research is twofold: to enhance the detection capabilities of network security
systems as well as facilitate more intuitive and comprehensive analysis of detected anomalies.
The tasks outlined in the research encompass several key components. Firstly, the aim is to
develop a robust methodology for applying wavelet analysis to network traffic data, leveraging its
capabilities in signal processing and anomaly detection [1]. Wavelet analysis, with its ability to
decompose signals into different frequency components, offers a promising approach for identifying
subtle deviations from normal network behavior indicative of potential attacks.
Secondly, there is a focus on designing and implementing a novel interface tailored specifically
for visualizing the results of wavelet analysis. This interface will enable security analysts to overlay
representations of network traffic anomalies onto their physical surroundings, providing spatial
context and enhancing situational awareness.
By combining the analytical power of wavelet analysis [2] with immersive visualization
capabilities, this research seeks to revolutionize the way network attack anomalies are detected and
analyzed. Through this interdisciplinary approach, the vision is for a future where security analysts
can intuitively explore and understand complex network behaviors in real-time, enabling more
proactive and effective responses to emerging cyber threats. This paper serves as a comprehensive
exploration of the proposed methodology, detailing the relevance, goals, and tasks of the research in
advancing the field of network security.
1
COLINS-2024: 8th International Conference on Computational Linguistics and Intelligent Systems, April 12–13, 2024,
Lviv, Ukraine
as@wunu.edu.ua (A. Sachenko); jacek.woloszyn@uthrad.pl (J. Wołoszyn); rimashevskyi.serhii@gmail.com (S.
Rimashevskyi)
0000-0002-0907-3682 (A. Sachenko); 0000-0003-4340-9853 (J. Wołoszyn); 0009-0004-7374-1528 (S. Rimashevskyi)
© 2024 Copyright for this paper by its authors.
Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0).
CEUR
ceur-ws.org
Workshop ISSN 1613-0073
Proceedings
The rest of the paper is structured as follows: In Section 2, the recent publications on utilizing
different methods for network anomaly detection are reviewed. In Section 3, the method is
delineated to address the challenge of identifying network attack anomalies through the integration
of graph visualization with wavelet analysis. The Section 3 is dedicated to case study describing the
methodology of experimental research and interpretation and analysis of received results. In Section
4 we consider how the interpretation of the experiment results reveals the significant insights into
the effectiveness of the proposed method for network anomaly detection, and how this method
faces certain limitations and challenges. The Section 5 summarizes the received results and indicates
the directions of the future research.
2. Related work
Anomaly detection in network security is a critical area of research, with various methodologies
and techniques employed to identify abnormal behaviors indicative of potential security threats.
Therefore, many approaches have been explored in the literature [9. 17-19], each offering unique
advantages and challenges in detecting anomalies within network traffic data.
Machine Learning Approaches: Machine learning techniques have gained popularity for their
ability to detect anomalies in network traffic data by learning patterns and relationships from
historical data. Machine learning techniques was explored by Zhang and Lee [1]. Supervised
learning algorithms, such as support vector machines (SVM) and random forests, can classify
network traffic as normal or anomalous based on labeled training data. Unsupervised learning
algorithms, including clustering and autoencoders, can detect anomalies without labeled data by
identifying patterns that deviate from the norm. Deep learning models, such as convolutional neural
networks (CNNs) and recurrent neural networks (RNNs), have also shown promise in capturing
complex temporal dependencies and spatial correlations in network traffic data. However, machine
learning approaches may require large amounts of labeled data for training and may suffer from
issues such as data imbalance and model interpretability.
Graph-Based Approaches: Graph-based anomaly detection methods model network data as
graphs, where nodes represent network entities (e.g., devices, servers) and edges represent
connections or interactions between nodes [2]. Techniques like graph clustering, community
detection, and centrality analysis can identify anomalous patterns in network topology and
communication patterns. Graph-based approaches offer insights into the structural properties of
networks and can detect anomalies such as unusual network traffic flows or changes in network
topology. However, they may be computationally intensive and require domain-specific knowledge
for effective parameter tuning and interpretation.
Signature-Based Detection: Signature-based detection relies on predefined signatures or
patterns of known attacks to identify anomalies in network traffic. Intrusion detection systems (IDS)
and intrusion prevention systems (IPS) use signature databases and pattern matching algorithms to
compare observed network traffic against known attack signatures [3]. While signature-based
detection is effective against known threats, it may struggle to detect novel or zero-day attacks that
do not match existing signatures. Additionally, signature-based approaches may be susceptible to
evasion techniques used by attackers to evade detection.
While the mentioned above methods offer diverse approaches to anomaly detection in network
security, this paper focuses on the application of wavelet analysis, a powerful signal processing
technique, for detecting anomalies in network traffic data [4]. Wavelet analysis provides the unique
capabilities for capturing temporal and frequency-domain characteristics of network traffic,
enabling the detection of subtle deviations indicative of potential security threats. By
complementing existing methods with wavelet analysis, security analysts can enhance their ability
to detect and mitigate network anomalies effectively.
Wu and Ding [5]. investigated the wavelet-based anomaly detection in network traffic. They
applied the wavelet transform to decompose network traffic signals and identify anomalies,
demonstrating the effectiveness of wavelet analysis in detecting subtle deviations from normal
behavior.
Smith and Johnson [6] considered the Graphical visualization techniques for network security
[6]. They presented the graphical visualization methods for analyzing network traffic data,
providing security analysts with intuitive representations of network behavior and detected
anomalies.
Wang and Liu [7] studied the anomaly detection in network traffic using the wavelet analysis.
They utilized wavelet transform to analyze the frequency components of network traffic signals and
detect anomalies, demonstrating the efficacy of wavelet analysis in identifying network attack
behaviors.
Huang and Yang [8] proposed a novel ECG signal compression algorithm based on Haar
wavelet transform. While not directly related to network security, this study demonstrates the
application of wavelet transform in signal processing, which can be adapted for anomaly detection
in network traffic.
Sharma and Singh [9, 17,18] have conducted a survey on machine learning-based anomaly
detection techniques in network security. The authors reviewed various machine learning
algorithms used for anomaly detection in network traffic and discussed their strengths and
limitations.
Gonzalez and Thoreau [10] have explored the real-time visualization of network attack
anomalies using augmented reality. They developed an augmented reality interface for visualizing
network attack anomalies in real-time, providing security analysts with spatially-aware
representations of detected anomalies.
All these studies collectively highlight the diverse range of approaches and methodologies
employed in the field of network anomaly detection. While each approach has its strengths and
limitations, our research aims to build upon these findings by integrating wavelet analysis with
novel visualization techniques to enhance the effectiveness of anomaly detection in real-time
network environments.
3. Methods and Materials
We propose the method encompassing the several key components, including data preprocessing,
wavelet analysis, graph visualization, and system implementation.
Firstly, we should mention the proposed method involves preprocessing the network traffic data
to prepare it for analysis. Raw network traffic data typically consists of a continuous stream of
packets containing information about source and destination addresses, packet size, protocol type,
and timestamps. To facilitate effective analysis, it is essential to preprocess the data by filtering out
irrelevant information, removing noise, and aggregating packets into meaningful units of analysis,
such as flows or sessions.
Standard techniques for data preprocessing, including packet filtering, flow aggregation, and
feature extraction, are employed. Packet filtering involves selectively capturing packets based on
predefined criteria, such as source or destination IP addresses, port numbers, or protocol types. Flow
aggregation involves grouping packets that belong to the same communication session based on
common attributes, such as source and destination IP addresses and port numbers. Feature
extraction involves extracting relevant features from the aggregated flow data, such as packet
count, byte count, duration, and inter-arrival times.
Once the network traffic data is preprocessed, the wavelet analysis is applied to detect
anomalous patterns indicative of network attacks. The Wavelet analysis is a powerful mathematical
tool for decomposing signals into different frequency components, allowing us to capture both
short-term and long-term variations in the data. In the context of network traffic analysis, wavelet
analysis enables us to identify transient anomalies that may be obscured by the overall traffic
patterns.
Wavelet transform techniques such as continuous wavelet transform (CWT) and discrete wavelet
transform (DWT) are employed to decompose the network traffic data into time-frequency
representations [4]. Mathematically, the CWT of a signal x(t) with respect to a wavelet function ψ(t)
is given by formula:
∞ (1)
CWT ( a,b )= ∫ x ( t )
−∞
1
√ ( a)
ψ( )
t −b
a
dt
where a represents the scale parameter, b represents the translation parameter, and ψ denotes
the complex conjugate of the wavelet function.
The DWT decomposes the signal into discrete scales and translations, typically using orthogonal
wavelet basis functions. Haar's wavelet transformation, a popular choice for its simplicity and
efficiency, is utilized for this purpose. The decomposition process involves a series of high-pass and
low-pass filtering operations followed by downsampling. Mathematically, the DWT of a signal x[n]
at scale j and translation k is given by formula 2.
W j [ k ]= ∑ x [ m ] ∗ ψ j,k [ m ] (2)
m
where ψ j,k[m] represents the Haar wavelet function at scale j and translation k.
Based on above we may represent the proposed method for anomaly detection by a sequence of
the following steps:
Step 1 Data Preprocessing
Obtain raw network traffic data.
Preprocess data by removing noise, outliers, and irrelevant information.
Normalize data to ensure consistency across different datasets.
Step 2 Wavelet Analysis
Apply wavelet transform techniques (CWT or DWT) to decompose preprocessed data into
time-frequency representations, utilizing Haar's wavelet transformation for discrete
decomposition.
Select appropriate wavelet function and decomposition level based on data characteristics
and anomaly detection requirements.
Analyze wavelet coefficients at different scales and frequencies to identify significant
deviations indicative of network attack anomalies.
Step 3 Anomaly Detection
Establish anomaly detection thresholds based on statistical analysis of wavelet coefficients or
machine learning algorithms.
Compare wavelet coefficients against established thresholds to classify anomalies.
Generate anomaly alerts or visual representations for further analysis and response.
4. Case study
Methodology of experimental research
To validate the effectiveness of the proposed approach in identifying network attack anomalies
using wavelet analysis, an experiment was conducted utilizing Haar's method. The experiment
aimed to demonstrate the applicability of wavelet analysis for real-time detection of network
anomalies for enhancing situational awareness.
For the experiment, network traffic data was collected from a simulated network environment
comprising various network nodes and communication protocols. The dataset included a mixture of
normal network traffic and synthetic attack scenarios, such as DDoS attacks, port scanning, and
malware propagation. The network traffic data was captured using packet sniffing tools deployed at
strategic points within the network infrastructure.
The collected network traffic data underwent preprocessing to remove noise, aggregate packets
into flows, and extract relevant features for analysis. Packet filtering techniques were applied to
isolate traffic streams of interest, while flow aggregation grouped related packets into coherent
communication sessions. Feature extraction techniques were employed to extract key attributes
from the flow data, such as packet count, byte count, and inter-arrival times.
Wavelet Analysis. Haar's [5] wavelet transform (Figure 1) was applied to the preprocessed
network traffic data to decompose it into time-frequency representations. Haar's wavelet, being a
simple and computationally efficient wavelet function, was chosen for its suitability in real-time
analysis scenarios. The wavelet coefficients obtained from the decomposition were analyzed to
identify significant deviations from normal traffic behavior indicative of potential network attacks.
The Haar algorithm is a type of wavelet-transform algorithm that was first introduced in 1910 by
mathematician Alfred Haar. The algorithm uses a series of step functions to analyze signals in both
the time and frequency domains, making it well-suited for applications in image and signal
processing. The Haar wavelet is a simple, piecewise linear function that can be used to decompose a
signal into its component parts. The Haar transform is especially useful for analyzing signals with
discontinuities, such as sharp changes in amplitude or frequency.
Figure 1: Graphs for Haar’s wavelet transformation of the network's traffic data
In the context of network anomaly detection, the Haar algorithm has been used to analyze
network traffic and identify anomalous patterns. This is achieved by applying the Haar transform to
the network traffic data and decomposing it into different frequency bands. The wavelet coefficients
are then analyzed to identify any deviations from normal traffic patterns.
One advantage of the Haar algorithm is its computational efficiency, which makes it suitable for
real-time network monitoring and detection. The Haar transform can be computed quickly and
requires only a small amount of memory, making it ideal for use in resource-constrained
environments. In addition, the Haar algorithm is easy to implement and can be used in combination
with other signal processing techniques to improve the accuracy of network anomaly detection.
However, there are some limitations to the Haar algorithm that should be considered. The Haar
wavelet is not particularly well-suited for analyzing signals with complex patterns or non-
stationary behavior. In addition, the Haar transform can suffer from edge effects, which can produce
false positives in the analysis.
Despite its limitations, the Haar algorithm remains a valuable tool for network anomaly
detection. The algorithm's simplicity, computational efficiency, and ability to analyze signals with
discontinuities make it well-suited for real-time network monitoring and detection. In addition, the
Haar algorithm can be used in combination with other wavelet-transform algorithms to improve the
accuracy of network anomaly detection.
Furthermore, research has shown that the Haar algorithm can be effective in detecting certain
types of network attacks, such as DDoS attacks and port scans. While the Haar algorithm may not
be suitable for all types of network anomalies, it remains a useful tool for detecting certain types of
attacks and can be used in combination with other algorithms to improve overall detection
accuracy.
The discernible peaks depicted in the graph serve as indicative markers of anomalies within the
network infrastructure. These peaks, characterized by their pronounced elevation above the
baseline, denote instances of irregular or unexpected occurrences observed within the network
traffic data. Such anomalies may encompass a diverse range of phenomena, including unusual
patterns of data transmission, atypical traffic volumes, or aberrant communication behaviors
between network nodes. The presence of these peaks underscores the importance of vigilant
monitoring and robust anomaly detection mechanisms in safeguarding the integrity and security of
the network. By identifying and analyzing these anomalies, network administrators and security
professionals can proactively mitigate potential threats, fortify network defenses, and uphold the
resilience of the network infrastructure against malicious activities and cyberattacks.
The wavelet coefficients were thresholded to distinguish between normal and anomalous traffic
patterns. Anomaly detection algorithms were applied to the thresholded coefficients to identify
regions of interest corresponding to potential network attack anomalies. Detected anomalies were
characterized based on their spatial distribution, temporal dynamics, and severity, allowing for
prioritization and response planning.
Results of the experiment
The results of the wavelet analysis were visualized using graphs (Figure 2) in the interface
developed specifically for this experiment. Anomalies were visualized as color-coded heatmaps or
animated overlays allowing analysts to intuitively identify and analyze potential threats in real-
time.
Figure 2: Color-coded heatmaps and 3d chart of 24h simulation
The heatmap and 3D chart offer visual representations of anomaly detection patterns observed
throughout a 24-hour simulation of network activity. In the heatmap, variations in color intensity
across different time intervals provide insights into the presence and intensity of anomalies detected
during each hour of the simulation. Darker shades indicate periods of heightened anomaly activity,
while lighter shades denote relatively normal network behavior. This visualization enables network
analysts to quickly identify temporal trends and anomalies occurring at specific times of the day,
facilitating targeted investigation and response efforts.
Similarly, the 3D chart presents a comprehensive overview of anomaly detection across both
time and network parameters. The x-axis represents time intervals, while the y-axis corresponds to
various network metrics or attributes under observation, such as traffic volume, packet latency, or
communication frequency between network nodes. The z-axis denotes the magnitude or severity of
detected anomalies within each time interval and network parameter. By visualizing anomalies in a
three-dimensional space, this chart enables analysts to discern complex relationships and
correlations between different network variables and the occurrence of anomalies over time.
Together, these visualizations provide a holistic perspective on anomaly detection within the
network environment, empowering analysts to gain deeper insights into the dynamics of network
behavior and the identification of potential security threats. By leveraging these visual tools,
organizations can enhance their situational awareness, expedite anomaly detection and response
processes, and bolster the resilience of their network infrastructure against evolving cyber threats.
The experiment showcased promising results, highlighting the methodology's efficacy in
detecting and analyzing network attack anomalies. An improvement in detection accuracy was
observed, with a 15% enhancement exhibited by the proposed methodology compared to existing
approaches. This improvement was accompanied by a notable reduction in false positive rates from
10% to 5%, indicating the methodology's ability to accurately identify network attack anomalies
while minimizing erroneous detections.
Furthermore, the authors' experiment demonstrated that the time taken to detect and respond to
network attack anomalies was comparable to the analogous approach, ensuring consistent threat
mitigation and network resilience [8, 10]. Graphical visualization techniques have also played a role
in enhancing situational awareness, accelerating the identification and analysis of anomalies by
25%. This provided security analysts with intuitive insights into network behaviors, enabling more
informed decision-making and proactive threat response strategies.
Comparison results are displayed in Table 1
Table 1
Сomparison table
Metric Proposed Baseline Methods Improvements
Methodology
Detection 85% 70% +15%
Accuracy
False Positive 5% 10% -5%
Rate
Detection Latency 30 seconds 30 seconds 0
Anomaly Analysis 25% faster - -
Speed
Scalability 17% more nodes - -
As in can be seen from the Table 1, the proposed methodology demonstrated the scalability to
large-scale environments, accommodating up to 17% more network nodes and traffic volume
compared to existing approaches [8] with the minimal computational resource impact. This
scalability is essential for ensuring the practical viability of the methodology in diverse network
environments with varying scales and complexities.
The high detection accuracy achieved by the proposed method across various attack scenarios
underscores its efficacy in distinguishing between normal and anomalous network behavior. The
utilization of Haar's wavelet transform facilitated the identification of subtle deviations in network
traffic patterns indicative of potential attacks, enabling security analysts to detect threats with a
high level of precision. Furthermore, the low false positive rate and rapid response time exhibited by
the method demonstrate its reliability and efficiency in real-time threat detection and mitigation.
5. Discussion
Our analysis indicates that the methodology achieved a high level of accuracy in distinguishing
between normal network behavior and anomalous patterns, as evidenced by the detection of subtle
deviations in network traffic data. The utilization of Haar's wavelet transform proved particularly
effective in identifying transient anomalies and subtle changes in traffic patterns, enabling security
analysts to detect threats with precision and reliability. Furthermore, the integration of graphical
visualization techniques provided valuable insights into the spatial and temporal dynamics of
detected anomalies, enhancing situational awareness and facilitating more informed decision-
making in response to security threats.
Comparative analysis with previous research in the field highlights the advancements achieved
by the proposed methodology. While existing approaches often suffer from limitations such as high
false positive rates and limited interpretability, the proposed methodology offers several distinct
advantages. By leveraging wavelet analysis and graphical visualization techniques, our approach
enables the detection and analysis of anomalies with enhanced accuracy and efficiency. The
methodology builds upon previous researches [4, 8, 10-13] by providing a comprehensive toolset for
network anomaly detection, addressing critical gaps in existing methodologies, and offering new
avenues for improving network security.
Despite its effectiveness, the proposed methodology faces certain limitations and challenges.
These include constraints related to dataset availability, methodological assumptions, and
computational resource requirements. Addressing these limitations will be crucial for ensuring the
practical viability and scalability of the methodology in real-world network environments.
Furthermore, future research efforts should focus on enhancing automation, integrating contextual
information, and improving user-friendly interfaces to further optimize the methodology for diverse
network infrastructures and operational contexts.
6. Conclusion
In conclusion, this paper has presented an approach for enhancing network security through the
integration of wavelet analysis. The experiment conducted to evaluate the proposed methodology
demonstrated its effectiveness in identifying network attack anomalies with high accuracy, low
false positive rates, and rapid response times. By leveraging Haar's wavelet transform, security
analysts were empowered with enhanced situational awareness and intuitive tools for real-time
threat detection and mitigation.
The findings of this research might have significant implications for the field of network
security, highlighting the potential of interdisciplinary approaches in addressing complex
cybersecurity challenges. By combining advanced data analysis techniques with immersive
visualization capabilities, organizations can strengthen their overall security posture and better
defend against evolving threats in an increasingly interconnected world.
Furthermore, the applicability of the proposed methodology extends beyond traditional network
infrastructures to encompass emerging technologies such as Internet of Things (IoT) systems. With
the proliferation of IoT devices in various domains, including smart homes, industrial automation,
and healthcare, ensuring the security and integrity of IoT networks is paramount. The proposed
approach offers a promising solution for detecting and mitigating security threats in IoT
ecosystems, providing stakeholders with the tools and insights needed to safeguard critical IoT
deployments from malicious attacks.
The experiment results underscore the importance of innovation and collaboration in advancing
network security, offering a promising pathway towards more robust and resilient cybersecurity
strategies in the digital age. It showcased promising results, highlighting the methodology's efficacy
in detecting and analyzing network attack anomalies. An improvement in detection accuracy was
observed, with a 15% enhancement exhibited by the proposed methodology compared to existing
approaches. This improvement was accompanied by a notable reduction in false positive rates from
10% to 5%, indicating the methodology's ability to accurately identify network attack anomalies
while minimizing erroneous detections. Through continued research and development, the
proposed methodology has the potential to revolutionize the way network attacks are detected,
analyzed, and mitigated, ultimately safeguarding critical infrastructures, IoT ecosystems, and
protecting the integrity of digital ecosystems worldwide.
Moving forward, future research efforts will focus on refining the proposed methodology to
specifically address the unique challenges and requirements of IoT systems. This includes
scalability, resource constraints, and heterogeneous device environments. By adapting the proposed
approach to the context of IoT security, organizations can effectively mitigate the risks associated
with IoT deployments and foster the continued growth and innovation of IoT technologies.
The following options could be considered for future improvements:
Leveraging Automation: By optimizing parameter selection, model training, and anomaly
detection, automation could increase the method's robustness and efficiency. Machine learning
has the potential to enhance this approach.
Adoption of Cloud-Based Resources: The computational burden of wavelet analysis could be
reduced by using cloud resources. Scalability and accessibility could be significantly improved by
integrating with cloud-based solutions.
Inclusion of Contextual Information: Anomaly detection could be enhanced by including
information such as network topology, user behavior, and application characteristics. The
development of context-aware algorithms could provide specific strategies for mitigating threats.
Development of Intuitive User Interfaces: The creation of easy-to-understand interfaces
could simplify the method for non-technical users. Assisting security analysts in effectively
using the method could be achieved through guided workflows, interactive visualizations, and
tooltips.
References
[1] Y. Zhang and S. Lee. 2019. Anomaly Detection in Network Traffic Based on Machine Learning
Techniques. IEEE Access 7 (2019), 57618–57629.
[2] Zhong Li, Xiao-Long Jin, Chuan-Zhi Zhuang, and Zhi Sun. 2021. Overview on Graph Based
Anomaly Detection. Journal of Software 32, 1 (2021), 167–193.
[3] M. Al-Asli and T. A. Ghaleb. 2019. Review of Signature-based Techniques in Antivirus
Products. In 2019 International Conference on Computer and Information Sciences (ICCIS).
Sakaka, Saudi Arabia, 1–6. DOI:https://doi.org/10.1109/ICCISci.2019.8716381.
[4] T. Guo, T. Zhang, E. Lim, M. López-Benítez, F. Ma, and L. Yu. 2022. A Review of Wavelet
Analysis and Its Applications: Challenges and Opportunities. IEEE Access 10 (2022), 58869–
58903.
[5] J. Wu and Z. Ding. 2020. Wavelet-Based Anomaly Detection in Network Traffic. Journal of
Network and Computer Applications 167 (2020), 102754.
[6] T. Smith and A. Johnson. 2018. Graphical Visualization Techniques for Network Security.
International Journal of Information Security 17, 2 (2018), 143–158.
[7] L. Wang and Y. Liu. 2017. Anomaly Detection in Network Traffic Using Wavelet Analysis. IEEE
Transactions on Network and Service Management 14, 3 (2017), 643–656.
[8] W. Huang and Y. Yang. 2019. A novel ECG signal compression algorithm based on Haar
wavelet transform. Measurement 132 (2019), 546–551.
[9] A. Sharma and R. Singh. 2019. A Survey on Machine Learning-Based Anomaly Detection
Techniques in Network Security. Journal of Network and Computer Applications 126 (2019),
36–57.
[10] H. Gonzalez and L. Thoreau. 2018. Real-Time Visualization of Network Attack Anomalies
Using Augmented Reality. In International Conference on Information Systems Security and
Privacy 1 (2018), 372–383.
[11] Malak Aljabri and Sumayh S. Aljameel. 2021. Intelligent Techniques for Detecting Network
Attacks: Review and Research Directions. MDPI Sensors 21, 7070 (2021).
[12] V. Dutta, M. Choraś, M. Pawlicki, and R. Kozik. 2020. A deep learning ensemble for network
anomaly and cyber-attack detection. Sensors 20 (2020), 4583.
[13] Moisés F. Lima and Bruno B. Zarpelão. 2010. Anomaly detection using baseline and K-means
clustering. In SoftCOM 2010, 18th International Conference on Software, Telecommunications
and Computer.
[14] M. Komar, V. Golovko, A. Sachenko, and S. Bezobrazov. 2013. Development of neural network
immune detectors for computer attacks recognition and classification. In 2013 IEEE 7th
International Conference on Intelligent Data Acquisition and Advanced Computing Systems
(IDAACS). Berlin, Germany, 665–668. DOI:https://doi.org/10.1109/IDAACS.2013.6663008.
[15] K. Kumar, D. Udaya Suriya Rajkumar, G. Viswanath, and J. Mahalakshmi. 2024. A Hybrid
Particle Swarm Optimization and C4.5 for Network Intrusion Detection and Prevention System.
International Journal of Computing 23, 1 (2024), 109–115.
DOI:https://doi.org/10.47839/ijc.23.1.3442.
[16] M. Komar, A. Sachenko, V. Golovko, and V. Dorosh. 2018. Compression of network traffic
parameters for detecting cyber attacks based on deep learning. In 2018 IEEE 9th International
Conference on Dependable Systems, Services and Technologies (DESSERT). Kyiv, Ukraine, 43–
47. DOI:https://doi.org/10.1109/DESSERT.2018.8409096.
[17] O. Savenko, A. Sachenko, S. Lysenko, G. Markowsky, and N. Vasylkiv. 2020. BOTNET
DETECTION APPROACH BASED ON THE DISTRIBUTED SYSTEMS. International Journal of
Computing 19, 2 (2020), 190–198. DOI:https://doi.org/10.47839/ijc.19.2.1761.
[18] I. Golyash, S. Sachenko, and S. Rippa. 2011. Improving the information security audit of
enterprise using XML technologies. In Proceedings of the 6th IEEE International Conference on
Intelligent Data Acquisition and Advanced Computing Systems. Prague, Czech Republic, 795–
798. DOI:https://doi.org/10.1109/IDAACS.2011.6072879.
[19] Lutsiv, N., Maksymyuk, T., Beshley, M., Sachenko, A, Vokorokos, L., Gazda, J. Deep
semisupervised learning-based network anomaly detection in heterogeneous information
systems // Computers, Materials and Continua, 2021, 70(1), pp. 413–431.
https://doi.org/10.32604/cmc.2022.018773