A.S. Bugaev, O.I. Sheluhin

Studies have shown that network traffic is self-similar on time scales of the order of several hundred milliseconds or more. At the same time, it also shows the multifractal properties in smaller time scales (order of milliseconds). Self-similarity reflects the long-term behavior of the measured signal and displays multifractal properties of the instantaneous behavior of the signal. In this paper we consider the application of wavelet transform modulus maxima method (WTMM) to the problem of detecting anomalies in telecommunications traffic. As the analyzed sequences were taken datasets that represent the network traffic collected at the border router of the campus network. In this article analyzed the sequence length of about 22 hours, with sampling step of 1s. Analysis of the multifractal spectra of samples shows that the differences in the characteristics of traffic with and without anomalies impacts on the charts of the singularity spectrum, which can be found using the WTMM. It is shown that the Hausdorff dimension of analyzed samples the most distinguished for a small number of levels (octaves) of the decomposition. Information dimension of comparable samples differ in small but constant and almost independent of the number of levels of decomposition. On this basis it is concluded that the difference of fractal dimensions with and without anomalous traffic spikes can potentially be used as a helpful feature for solving the problem of detection