关键词: 网络流量, ARMA-GARCH模型, 小波分析, ARCH 效应

Abstract: This paper introduces the method of network traffic anomaly detection, then focus on the autoregressive moving average model (ARMA) and wavelet analysis method is introduced, and the introduction of autoregressive conditional heteroscedasticity model with ARCH effect, and the method of constructing the above model to provide. Then, the wavelet analysis and time series analysis with ARCH effect are used to decompose and reconstruct the network traffic of the UnionPay network, and the low-frequency, high-frequency and surge terms are obtained. According to whether the subsequences have conditional heteroscedasticity, the ARMA model or the ARMA-GARCH model is established for the corresponding subsequence, and all the subsequences are linearly combined to obtain the network traffic model. The network flow model and construction of the original data and does not take into account the time series model of conditional heteroscedasticity are compared, the result shows that the average error of the network traffic model construction rate smaller, qualified rate of prediction is higher, so the result is better, and so as to construct the prediction value of abnormal network traffic detection for the accurate baseline.

Key words: network flow, ARMA-GARCH model, wavelet analysis, ARCH effect