Abstract: This paper introduces the method of network traffic anomaly detection, then focus on the autoregressive moving average model (ARMA) and wavelet analysis method is introduced, and the introduction of autoregressive conditional heteroscedasticity model with ARCH effect, and the method of constructing the above model to provide. Then, the wavelet analysis and time series analysis with ARCH effect are used to decompose and reconstruct the network traffic of the UnionPay network, and the low-frequency, high-frequency and surge terms are obtained. According to whether the subsequences have conditional heteroscedasticity, the ARMA model or the ARMA-GARCH model is established for the corresponding subsequence, and all the subsequences are linearly combined to obtain the network traffic model. The network flow model and construction of the original data and does not take into account the time series model of conditional heteroscedasticity are compared, the result shows that the average error of the network traffic model construction rate smaller, qualified rate of prediction is higher, so the result is better, and so as to construct the prediction value of abnormal network traffic detection for the accurate baseline.

Key words: network flow, ARMA-GARCH model, wavelet analysis, ARCH effect

摘要： 本文首先介绍了网络流量异常检测的方法，之后重点对自回归滑动平均模型（ ）和小波分析方法做了介绍，同时引入带有 效应的自回归条件异方差模型，并对以上模型的构建提供了方法。之后利用小波分析和带有 效应的时间序列分析方法对银联网络流量进行分解与重构，得到低频项、高频项和激增项。根据各子序列是否具有条件异方差性对相应子序列建立 模型或 模型，并将所有的子序列进行线性组合得到网络流量模型。将构建的网络流量模型和原始数据和未考虑条件异方差性的时间序列模型进行对比，对比结果发现构建的网络流量模型平均误差率更小、预测合格率更高，因此其结果更优，并依此作为构建网络异常流量检测基线的预测值更为准确。

关键词: 网络流量, ARMA-GARCH模型, 小波分析, ARCH 效应