Abstract:

In the field of network security, data theft detection is an important part of research contents. This paper proposes a time series decomposition algorithm in network traffic scenarios which decomposes data into three parts of seasonal data, trend data and residual data. The algorithm uses median in sliding window to fit better with the trend data, filters discrete single points, and takes the time interval containing continuous outliers as the final output form of the algorithm. The paper proposes that the information entropy of payload length is helpful detecting the hidden data theft behaviors. In the part of experiment, the algorithm is compared with STL and Piecewise Median algorithm. The algorithm is used to detect the time series that are processed with information entropy tool. Experiments show that, compared with STL and Piecewise Median algorithm, this algorithm improves the performances greatly, data theft detection effect is well.

Key words: large-scale server, data theft, time series decomposition, sliding window