Comparison of different threshold values for a wavelet designed attack sensor

Wavelet transform has emerged recently as a tool to detect web traffic anomalies. Under the assumption that an attack produces a substantial variation on the web traffic, to identify anomalies wavelet based methods consider a threshold value for deciding if wavelet coefficients are associated to anomalies or not. This paper explores different strategies to define the threshold value in association to the bidimensional discrete wavelet transform. Four strategies have been tested (MAD, AD, κL, MM), being MM a new heuristic proposed in this work. Simulations show that κL and AD present quite good results with the compromise of saving computational cost, while MAD and MM are computationally expensive.