Network Traffic Anomaly Detection Method Based on a Feature of Catastrophe Theory

For the existing problems of current network traffic anomaly detection, the behavior of the network traffic anomaly will show nonlinearity, non-stationarity and complexity according to the network traffic often driven by the control of multiple factors. Owing to the characteristic that the internal evolution equation will lead to dynamical structure catastrophe, the phase space reconstruction method and the statistical physics method can be used to compute the macro feature values of the network traffic. By choosing some of the feature values which can obviously retlect the unusual change in the network traffic volume as control variables, a network traffic anomaly detection method based on the catastrophe series theory model is developed. Many experimental results show that the proposed network traffic anomaly detection method has a low false alarm rate under the same condition of detection rate.     

Local order, entropy and predictability of financial time series

We consider time series of financial data as the Dow Jones Index with respect to the existence of local order. The basic idea is that in spite of the high stochasticity in average there might be special local situations where there local order exist and the predictability is considerably higher than in average. In order to check this assumption we discretise the time series and investigate the frequency of the continuation of definite words of length n first. We prove the existence of relatively long-range correlations under special conditions. The higher order Shannon entropies and the conditional entropies (dynamical entropies) are calculated, characteristic fluctuations are found. Instead of the dynamic entropies which yield mean values of the uncertainty/predictability we finally investigate the local values of the uncertainty/predictability and the distribution of these quantities. Received 19 January 2000     

Random, but not so much a parameterization for the returns and correlation matrix of financial time series

A parameterization that is a modified version of a previous work is proposed for the returns and correlation matrix of financial time series and its properties are studied. This parameterization allows easy introduction of non-stationarity and it shows several of the characteristics of the true, observed realizations, such as fat tails, volatility clustering, and a spectrum of eigenvalues of the correlation matrix that can be understood as an extension of Random Matrix Theory results. The predicted behavior of this parameterization for the eigenvalues is compared with the eigenvalues of Brazilian assets and it is shown that those predictions fit the data better than Random Matrix Theory.     

Correlation measure to detect time series distances, whence economy globalization

An instantaneous time series distance is defined through the equal time correlation coefficient. The idea is applied to the Gross Domestic Product (GDP) yearly increments of 21 rich countries between 1950 and 2005 in order to test the process of economic globalisation. Some data discussion is first presented to decide what (EKS, GK, or derived) GDP series should be studied. Distances are then calculated from the correlation coefficient values between pairs of series. The role of time averaging of the distances over finite size windows is discussed. Three network structures are next constructed based on the hierarchy of distances. It is shown that the mean distance between the most developed countries on several networks actually decreases in time, —which we consider as a proof of globalization. An empirical law is found for the evolution after 1990, similar to that found in flux creep. The optimal observation time window size is found ?15 years.     

Fractional Brownian motion, fractional Gaussian noise, and Tsallis permutation entropy

In this work, we analyze two important stochastic processes, the fractional Brownian motion and fractional Gaussian noise, within the framework of the Tsallis permutation entropy. This entropic measure, evaluated after using the Bandt & Pompe method to extract the associated probability distribution, is shown to be a powerful tool to characterize fractal stochastic processes. It allows for a better discrimination of the processes than the Shannon counterpart for appropriate ranges of values of the entropic index. Moreover, we find the optimum value of this entropic index for the stochastic processes under study.     

Long term memory in extreme returns of financial time series

It is well known that while daily price returns of financial markets are uncorrelated, their absolute values (‘volatility’) are long-term correlated. Here we provide evidence that certain subsequences of the returns themselves also exhibit long-term memory. These subsequences consist of maxima (or minima) of returns in consecutive time windows of R days. Our analysis shows that for both stocks and currency exchange rates, long-term correlations are significant for R≥4. We argue that this long-term memory which is similar to that observed in volatility clustering sheds further insight on price dynamics that might be used for risk estimation.     

Analyses of Optimal Embedding Dimension and Delay for Local Linear Prediction Model

In the reconstructed phase space, a novel local linear prediction model is proposed to predict chaotic time series. The parameters of the proposed model take the values that are different from those of the phase space reconstruction. We propose a criterion based on prediction error to determine the optimal parameters of the proposed model. The simulation results show that the proposed model can effectively make one-step and multistep prediction for chaotic time series, and the one-step and multi-step prediction accuracy of the proposed model is superior to that of the traditional local linear prediction.     

Multiresolution analysis of fluctuations in non-stationary time series through discrete wavelets

We illustrate the efficacy of a discrete wavelet based approach to characterize fluctuations in non-stationary time series. The present approach complements the multifractal detrended fluctuation analysis (MF-DFA) method and is quite accurate for small size data sets. As compared to polynomial fits in the MF-DFA, a single Daubechies wavelet is used here for detrending purposes. The natural, built-in variable window size in wavelet transforms makes this procedure well suited for non-stationary data. We illustrate the working of this method through the analysis of binomial multifractal model. For this model, our results compare well with those calculated analytically and obtained numerically through MF-DFA. To show the efficacy of this approach for finite data sets, we also do the above comparison for Gaussian white noise time series of different sizes. In addition, we analyze time series of three experimental data sets of tokamak plasma and also spin density fluctuations in 2D Ising model.     

Multifractality in the random parameter model for multivariate time series

The Random Parameter model was proposed to explain the structure of the covariance matrix in problems where most, but not all, of the eigenvalues of the covariance matrix can be explained by Random Matrix Theory. In this article, we explore the scaling properties of the model, as observed in the multifractal structure of the simulated time series. We use the Wavelet Transform Modulus Maxima technique to obtain the multifractal spectrum dependence with the parameters of the model. The model shows a scaling structure compatible with the stylized facts for a reasonable choice of the parameter values.     

Analysis of the spatial and temporal distributions between successive earthquakes: Nonextensive statistical mechanics viewpoint

The spatial and temporal distributions between successive earthquakes are treated in the framework of nonextensive statistical mechanics. We find temporal distributions exhibit the power law behavior; q-exponential with q>1. It means the earthquakes are strongly correlated in time. The spatial distributions obey the q-exponential form with q<1. We also examine the dependence of the q exponent on magnitude range, covering period, time interval and size of the region where data are gathered. The conjecture of Abe et al. [S. Abe, N. Suzuki, Physica A 350 (2005) 588] has been examined for different categories of data. The results show a strange relation between q values of the spatial and temporal distributions.     

Globalization — Entropy unification through the Theil index

A time series is remapped onto an entropy concept, based on the Theil index. The Manhattan distance between these surrogate series is calculated, and contrasted to the usual correlation distance measure. The idea is applied to several Gross Domestic Product (relative increments) of rich countries. Such distances are calculated for various time window sizes. The role of time averaging in such finite size windows is discussed. We construct the locally minimum spanning tree (LMST) corresponding to the distance matrix. Another hierarchical network structure (Unidirectional Minimal Length Path) is compared with the LMST for confirming that the mean distance between the most developed countries on different networks actually decreases in time, — which we consider as a proof of economy globalization. It is stressed that this entropy distance measure seems more suitable in detecting some “phase transition” in time series, like a globalization process than the usual correlation based measure.     

Bivariate phase-rectified signal averaging

Phase-Rectified Signal Averaging (PRSA) was shown to be a powerful tool for the study of quasi-periodic oscillations and nonlinear effects in non-stationary signals. Here we present a bivariate PRSA technique for the study of the inter-relationship between two simultaneous data recordings. Its performance is compared with traditional cross-correlation analysis, which, however, does not work well for non-stationary data and cannot distinguish the coupling directions in complex nonlinear situations. We show that bivariate PRSA allows the analysis of events in one signal when the other signal is in a certain phase or state; it is stable in the presence of noise and impassible to non-stationarities.     

Detecting Determinism in Firing Activities of Retinal Ganglion Cells during Response to Complex Stimuli

Complex stimuli are used to probe the response properties of the chicken＇s retinal ganglion cells （GCs）. The correlation dimension method and the nonlinear forecasting method are applied to detect the determinism in the firing activities of the retinal GCs during response to complex stimuli. The inter-spike interval （ISI） series and the first difference of the ISI （DISI） series are analysed. Two conclusions are drawn. Firstly, the first difference operation of the ISI series makes it comparatively easier for determinism detection in the firing activities of retinal GCs. Secondly, the nonlinear forecasting method is more efficient and reliable than the correlation dimension method for determinism detection.     

Chaotic time series prediction: From one to another

In this Letter, a new local linear prediction model is proposed to predict a chaotic time series of a component x(t) by using the chaotic time series of another component y(t) in the same system with x(t). Our approach is based on the phase space reconstruction coming from the Takens embedding theorem. To illustrate our results, we present an example of Lorenz system and compare with the performance of the original local linear prediction model.     

Chaotic time series prediction and additive white Gaussian noise

Taken's delay embedding theorem states that a pseudo state-space can be reconstructed from a time series consisting of observations of a chaotic process. However, experimental observations are inevitably corrupted by measurement noise, which can be modelled as Additive White Gaussian Noise (AWGN). This Letter analyses time series prediction in the presence of AWGN using the triangle inequality and the mean of the Nakagami distribution. It is shown that using more delay coordinates than those used by a typical delay embedding can improve prediction accuracy, when the mean magnitude of the input vector dominates the mean magnitude of AWGN.     

Signal detection based on recurrence matrix statistics

This work considers the problem of detecting signals in noise in the absence of a well-defined signal model. Specifically, we compare detectors based on recurrence plots to one of the more commonly used detection strategies. Results indicate improvements are possible using the recurrence-based detectors for certain signal-to-noise ratios.     

Modeling network traffic using generalized Cauchy process

Processes with long-range dependence (LRD) have gained wide applications in many fields of science and technologies ranging from hydrology to network traffic. Two key properties of such processes are LRD that is characterized by the Hurst parameter H and self-similarity (SS) that is measured by the fractal dimension D. However, in the popular traffic model using fractional Gaussian noise (fGn), these two parameters are linearly related. This may be regarded as a limitation of fGn in traffic modeling from the point of view of either accurately fitting real traffic or appropriately explaining the particular multi-fractal phenomena of traffic. In this paper, we discuss recent results in traffic modeling from a view of the generalized Cauchy (GC) process. The GC process is indexed by two parameters D and H. The parameter D in the GC model is independent of H. Hence, it provides a more flexible way to describe the multi-fractal phenomena of traffic in addition to accurately modeling traffic for both short-term lags and long-term ones.     

Violation of the scaling relation and non-Markovian nature of earthquake aftershocks

The statistical properties of earthquake aftershocks are studied. The scaling relation for exponents of the Omori law and the power-law calm time distribution (i.e., the interoccurrence time distribution), which is valid if a sequence of aftershocks is a singular Markovian process, is carefully examined. Data analysis shows significant violation of the scaling relation, implying the non-Markovian nature of aftershocks.     

Multi-Scale Gaussian Processes： a Novel Model for Chaotic Time Series Prediction

Based on the classical Gaussian process （GP） model, we propose a multi-scale Gaussian process （MGP） model to predict the existence of chaotic time series. The MGP employs a covariance function that is constructed by a scaling function with its different dilations and translations, ensuring that the optimal hyperparameter is easy to determine. Moreover, the scaling function with its different dilations and translations can form a set of complete bases, resulting in the fact that the MGP can acquire better prediction performance than the GP. The experiments can lead to the following conclusions： （i） The MGP gives a relatively better prediction performance in comparison with the classical GP model. （ii） The prediction performance of the MGP is competitive with support vector machine （SVM）. They give better performance as compared to the radial basis function networks.