An QUIC Traffic Anomaly Detection Model Based on Empirical Mode Decomposition

• Published in: 2022 IEEE 23rd International Conference on High Performance Switching and Routing (HPSR) pp. 76 - 80
• Main Authors: Lei, Gang, Wu, Junyi, Gu, Keyang, Ji, Lejun, Cao, Yuanlong, Shao, Xun
• Format: Conference Proceeding
• Language: English
• Published: IEEE 06.06.2022
• Subjects: Empirical mode decomposition; Hurst parameters; Internet; network traffic; Protocols; QUIC; Routing; Simulation; Switches; Telecommunication traffic; the Empirical Mode Decomposition
• ISSN: 2325-5609
• DOI: 10.1109/HPSR54439.2022.9831335

With the advent of the 5G era, high-speed and secure network access services have become a common pursuit. The QUIC (Quick UDP Internet Connection) protocol proposed by Google has been studied by many scholars due to its high speed, robustness, and low latency. However, the research on the security of the QUIC protocol by domestic and foreign scholars is insufficient. Therefore, based on the self-similarity of QUIC network traffic, combined with traffic characteristics and signal processing methods, a QUIC-based network traffic anomaly detection model is proposed in this paper. The model decomposes and reconstructs the collected QUIC network traffic data through the Empirical Mode Decomposition (EMD) method. In order to judge the occurrence of abnormality, this paper also intercepts overlapping traffic segments through sliding windows to calculate Hurst parameters and analyzes the obtained parameters to check abnormal traffic. The simulation results show that in the network environment based on the QUIC protocol, the Hurst parameter after being attacked fluctuates violently and exceeds the normal range. It also shows that the anomaly detection of QUIC network traffic can use the EMD method.