Amos Ron

A signal analysis of network traffic anomalies

Identifying anomalies rapidly and accurately is critical to the efficient operation of large computer networks. Accurately characterizing important classes of anomalies greatly facilitates their identification; however, the subtleties and complexities of anomalous traffic can easily confound this process. In this paper we report results of signal analysis of four classes of network traffic anomalies: outages, flash crowds, attacks and measurement failures. Data for this study consists of IP flow and SNMP measurements collected over a six month period at the border router of a large university. Our results show that wavelet filters are quite effective at exposing the details of both ambient and anomalous traffic. Specifically, we show that a pseudo-spline filter tuned at specific aggregation levels will expose distinct characteristics of each class of anomaly. We show that an effective way of exposing anomalies is via the detection of a sharp increase in the local variance of the filtered data. We evaluate traffic anomaly signals at different points within a network based on topological distance from the anomaly source or destination. We show that anomalies can be exposed effectively even when aggregated with a large amount of additional traffic. We also compare the difference between the same traffic anomaly signals as seen in SNMP and IP flow data, and show that the more coarse-grained SNMP data can also be used to expose anomalies effectively.

Framelets: MRA-based constructions of wavelet frames

We discuss wavelet frames constructed via multiresolution analysis (MRA), with emphasis on tight wavelet frames. In particular, we establish general principles and specific algorithms for constructing framelets and tight framelets, and we show how they can be used for systematic constructions of spline, pseudo-spline tight frames, and symmetric bi-frames with short supports and high approximation orders. Several explicit examples are discussed. The connection of these frames with multiresolution analysis guarantees the existence of fast implementation algorithms, which we discuss briefly as well.  2002 Elsevier Science (USA). All rights reserved.

On the Construction of Multivariate (pre) Wavelets

A new approach for the construction of wavelets and prewavelets onRd from multiresolution is presented. The method uses only properties of shift-invariant spaces and orthogonal projectors fromL2(Rd) onto these spaces, and requires neither decay nor stability of the scaling function. Furthermore, this approach allows a simple derivation of previous, as well as new, constructions of wavelets, and leads to a complete resolution of questions concerning the nature of the intersection and the union of a scale of spaces to be used in a multiresolution.

On Multivariate Polynomial Interpolation

AbstractWe provide a map which associates each finite set Θ in complexs-space with a polynomial space πΘ from which interpolation to arbitrary data given at the points in Θ is possible and uniquely so. Among all polynomial spacesQ from which interpolation at Θ is uniquely possible, our πΘ is of smallest degree. It is alsoD- and scale-invariant. Our map is monotone, thus providing a Newton form for the resulting interpolant. Our map is also continuous within reason, allowing us to interpret certain cases of coalescence as Hermite interpolation. In fact, our map can be extended to the case where, with eachgq∈Θ, there is associated a polynomial space PΘ, and, for given smoothf, a polynomialq∈Q is sought for which

Approximation from Shift-Invariant Subspaces of L 2 (ℝ d )

p(D)(f - q)(\theta ) = 0, \forall p \in P_\theta , \theta \in \Theta

The least solution for the polynomial interpolation problem

.We obtain πΘ as the “scaled limit at the origin” (expΘ)↓ of the exponential space expΘ with frequencies Θ, and base our results on a study of the mapH→H↓ defined on subspacesH of the space of functions analytic at the origin. This study also allows us to determine the local approximation order from suchH and provides an algorithm for the construction ofH↓ from any basis forH.

A NECESSARY AND SUFFICIENT CONDITION FOR THE LINEAR INDEPENDENCE OF THE INTEGER TRANSLATES OF A COMPACTLY SUPPORTED DISTRIBUTION

The fiberization of affine systems via dual Gramian techniques, which was developed in previous papers of the authors, is applied here for the study of affine frames that have an affine dual system. Gramian techniques are also used to verify whether a dual pair of affine frames is also a pair of bi-orthogonal Riesz bases. A general method for a painless derivation of a dual pair of affine frames from an arbitrary MRA is obtained via the mixed extension principle.

Network Performance Anomaly Detection and Localization

A complete characterization is given of closed shift-invariant subspaces of L2(Rd) which provide a specified approximation order. When such a space is principal (i.e., generated by a single function), then this characterization is in terms of the Fourier transform of the generator. As a special case, we obtain the classical Strang-Fix conditions, but without requiring the generating function to decay at infinity. The approximation order of a general closed shift-invariant space is shown to be already realized by a specifiable principal subspace.