Attack detection by means of singular spectrum analysis

The paper considers the technique of singular spectrum analysis (“the caterpillar”) and its application in the sphere of network traffic time series analysis in order to detect DDoS-attacks against the Web-server. A decomposition of the source time series was carried out. Features of the eigenfunctions and major constituents of the series under different working conditions were revealed.