A Statistical Approach to Evaluation and Selection of Wavelets for Detecting Computer Attacks

Currently, wavelet analysis is becoming increasingly widespread as a promising means of detecting hidden information, encoded messages or changes in signals that may be associated with a security threat. Therefore, the possibility of using wavelet analysis to detect intrusions into computer systems and analyze network traffic is of considerable interest. This area has not yet been sufficiently explored since the effectiveness of attack detection by wavelet analysis is largely determined by the correct choice of the base wavelet, and the choice of the wavelet most suitable for analyzing specific data is more of an art than a mathematically based operation. To overcome this uncertainty, the paper proposes an approach to the evaluation and selection of wavelets for detecting computer attacks, which is based on the use of mathematical statistics methods. According to the proposed approach, the estimated wavelets are studied on the reference and noisy signals. The noise models the changes caused by the attack. Arrays of wavelet coefficients obtained from wavelet mapping of reference and noisy signals are subjected to statistical processing. It comes down to testing hypotheses about the equality of means, equality of variances, compliance of samples with a normal distribution and differences in the laws of sample distribution. The wavelet that allows the largest number of null hypotheses to be true is selected. The proposed approach was applied to Daubechies, Haar and Mexican Hat wavelets. The evaluation results showed that Mexican Hat is the most preferred wavelet for detecting computer attacks.