Abstract
Traffic-utilisation measurements for network monitoring are corrupted by additive noise and statistical drift, which manifests as time-dependent changes in the signal's mean, variance, distributional shape, or tail behaviour. Static wavelet denoising, calibrated under stationary independent and identically distributed (i.i.d.) Gaussian assumptions, becomes mismatched under drift and, at moderate-to-high signal-to-noise ratio (SNR), can overly suppress useful structure and degrade monitoring decisions.
We propose a drift-aware framework treating adaptive wavelet denoising as a preprocessing layer optimized for two tasks: anomaly detection, recovering the multi-scale transient load bursts obscured by noise and drift, and capacity estimation, recovering the operational required capacity $C_{95}$ (95th percentile of utilisation). Since localized bursts are multi-scale structures preserved by wavelets but removed by low-pass filters, detection must discriminate denoiser families.
A four-detector gate (Page-Hinkley, variance-ratio, Jensen-Shannon, Anderson-Darling) determines when to invoke a learned policy, and a Proximal Policy Optimization agent selects a per-window wavelet configuration over a mixed discrete-continuous action space. Unlike prior work, the reward is based on downstream task utility, not reconstruction fidelity. The denoiser is benchmarked, per drift type and input SNR, against a low-pass moving-average filter, VisuShrink, SureShrink, BayesShrink, and a Wiener filter. Defining the anomaly target on the clean signal and the drift gate on the corruption keeps both stages non-circular.
Blogger's Review: The proposed method significantly enhances the accuracy of network traffic anomaly detection by introducing a drift-aware mechanism, offering an effective solution to noise challenges in dynamic environments. The integration of reinforcement learning for strategy optimization shifts the focus from mere signal reconstruction to practical application utility, making it a valuable approach for the field.