Multiwavelets for Quantitative Pattern Matching Bruce Kessler Western Kentucky University Hawaiian International Conference on System Sciences Decision Technologies and Service Sciences Track Cyber Security and Information Sciences Research Mini-track January 6, 2009

Wavelet Basics Wavelets are signal processing and analysis tools, analogous to trigonometric polynomials in the Fourier transform. • Wavelet bases are local, with coefficients representing different translates of the basis. Thus, coefficients reflect not just if a feature occurs, but give some idea of where a feature occurs. • Wavelet transforms ignore polynomial components of the signal up to the approximation order of the basis. • There are a wide selection of wavelet bases that can be used, depending on the needs or application of the user. • Wavelet spaces are nested by dilation, so we get a multi-resolution analysis of our signal. • Multiwavelets can be simultaneously orthogonal (quick decompositions) and have symmetry properties.

Example with r = 1 (Haar)

Example with r = 1

orthogonal to integer translates What is approximation order? If a scaling vector  has approximation order k, then all of the spaces Vj generated by  will contain polynomials of degree k – 1. Approximation order 1 basis – just showed it to you. Approximation order 2 bases (Hardin, Geronimo, Massopust) orthogonal to integer translates

Another approximation order 2 basis (Daubechies) Also orthogonal to its integer translates, but not when restricted to a shorter interval with integer endpoints. Approximation order 3 bases (Donovan, Hardin, Massopust)

Approximation order 4 bases (DHM)

Approximation order 4 bases (with one derivative, K.)

When to use (multi)wavelets – Quantitative data. • Usage noise. Wavelet decompositions ignore signal components up to the polynomial approximation order of the basis, so a wavelet analysis to look for patterns over the top of background noise. • Random noise. Gaussian noise appears as wavelet coefficients that are very close to 0, so they have little effect (and can be threshholded out if we desire). • Non-sparse data. Multiwavelets allow us to build boundary basis functions, allowing us to ignore data outside our analysis window.

When not to use (multi)wavelets • Text searches. There is no advantage to using wavelets to look for character strings. 0000 00 1b 2f 9a 32 82 00 19 21 15 9a 31 08 00 45 00 ../.2... !..1..E. 0010 02 af f5 b3 40 00 80 06 28 f6 c0 a8 01 83 48 0e ....@... (.....H. 0020 cf 65 40 5a 00 50 bc e3 a1 1b 83 eb 15 b1 50 18 .by.Cyb erSchmUck 0030 ff ff ce b4 00 00 47 45 54 20 2f 76 69 64 65 6f ......GE T /video 0040 70 6c 61 79 3f 64 6f 63 69 64 3d 2d 31 32 39 33 play?doc id=-1293 0050 30 36 32 33 37 38 30 35 30 39 37 31 34 39 35 20 06237805 0971495 0060 48 54 54 50 2f 31 2e 31 0d 0a 41 63 63 65 70 74 HTTP/1.1 ..Accept 0070 3a 20 2a 2f 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 : */*..A ccept-La 0080 6e 67 75 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 55 nguage: en-us..U 0090 41 2d 43 50 55 3a 20 78 38 36 0d 0a 41 63 63 65 A-CPU: x 86..Acce 00a0 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 pt-Encod ing: gzi 00b0 70 2c 20 64 65 66 6c 61 74 65 0d 0a 55 73 65 72 p, defla te..User 00c0 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f -Agent: Mozilla/ 00d0 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 4.0 (com patible; 00e0 20 4d 53 49 45 20 37 2e 30 3b 20 57 69 6e 64 6f MSIE 7. 0; Windo 00f0 77 73 20 4e 54 20 35 2e 31 3b 20 2e 4e 45 54 20 ws NT 5. 1; .NET 0100 43 4c 52 20 31 2e 31 2e 34 33 32 32 3b 20 2e 4e CLR 1.1. 4322; .N 0110 45 54 20 43 4c 52 20 32 2e 30 2e 35 30 37 32 37 ET CLR 2 .0.50727 0120 3b 20 2e 4e 45 54 20 43 4c 52 20 33 2e 30 2e 30 ; .NET C LR 3.0.0 0130 34 35 30 36 2e 33 30 3b 20 2e 4e 45 54 20 43 4c 4506.30; .NET CL • Discrete state changes. Again, no advantage when the data is not changed by volume of traffic – only when quantifying amounts.

How do we find patterns using multiwavelets? 1) Generate a wavelet decomposition of your pattern using a particular scaling vector and the associated multiwavelet. 2) Generate a wavelet decomposition of the first block of data in your signal, and compare to the target decomp-osition, using the root mean-square error

Wavelet decomposition is found for this signature. Example • Attack packets have been identified by an analyst, and plotted (time stamp rounded to some level of accuracy vs. accumulated number or number of bytes of packets). bytes Wavelet decomposition is found for this signature. time

Attack started at 49.381 sec. RMSE ≈ 0.0947 Example • Wavelet decompositions of data blocks occurring over the same length of time are done from a suspect IP, sliding over the data, and a RMSE of the current data and the target decomposition. Attack started at 49.381 sec. RMSE ≈ 0.0947 Attack started at 25.413 sec. RMSE ≈ 0.0796

E-mail: bruce.kessler@wku.edu Acknowledgements This work supported in part by the NACMAST consortium under contract EWAGSI-07-SC-0003. Contact Information E-mail: bruce.kessler@wku.edu Web: www.wku.edu/~bruce.kessler “That’s all I’ve got say about that.” – Forrest Gump Questions?