arXiv:2607.20011eess.SPcs.AI2026-07

针对网络流量噪声与漂移,用强化学习优化小波去噪以提升异常检测和容量估计。

Drift-Aware RL-based Wavelet Denoising for Network-Traffic Anomaly Detection

论文配图:Drift-Aware RL-based Wavelet Denoising for Network-Traffic Anomaly Detection
图 1 · 摘自论文原文
  • 用强化学习动态选择小波去噪参数,适应信号漂移变化。
  • 在不同信噪比下优于传统滤波器,准确恢复突发负载和95%容量指标。
  • 适合网络监控中需实时去噪与异常发现的工程场景。

网络流量利用率监测数据受加性噪声和统计漂移(如均值、方差、分布形状或尾部行为随时间变化)影响。基于静态小波去噪方法在平稳独立同分布高斯假设下校准,面对漂移时失配,在中高信噪比下过度抑制有效结构,恶化监控决策。本文提出一种漂移感知框架,将自适应小波去噪作为预处理层,优化两个任务:异常检测(恢复被噪声与漂移掩盖的多尺度瞬态负载突增)和容量估计(恢复操作所需容量 $C_{95}$,即利用率的95百分位)。由于局部突增是小波保留而低通滤波器去除的多尺度结构,检测器用于区分不同去噪器性能。四重检测门(Page-Hinkley、方差比、Jensen-Shannon、Anderson-Darling)决定何时触发学习策略,近端策略优化代理在混合离散-连续动作空间中为每窗口选择小波配置。不同于以往工作,奖励函数基于下游任务效用而非重建保真度。去噪器在各类漂移类型与输入信噪比下,与移动平均低通滤波器、VisuShrink、SureShrink、BayesShrink及维纳滤波器进行对比。异常目标定义在干净信号上,漂移检测门基于污染信号,保证两阶段非循环。

原文摘要 · Abstract (English)

Traffic-utilisation measurements for network monitoring are corrupted by additive noise and statistical drift: time-dependent change in the signal's mean, variance, distributional shape, or tail behaviour. Static wavelet denoising, calibrated under stationary independent and identically distributed (i.i.d.) Gaussian assumptions, becomes mismatched under drift and, at moderate-to-high signal-to-noise ratio (SNR), over-suppresses useful structure and degrades monitoring decisions. We propose a drift-aware framework treating adaptive wavelet denoising as a preprocessing layer optimised for two tasks: anomaly detection, recovering the multi-scale transient load bursts that noise and drift obscure, and capacity estimation, recovering the operational required capacity $C_{95}$ (95th percentile of utilisation). Because localised bursts are multi-scale structure a wavelet preserves but a low-pass filter removes, detection discriminates denoiser families. A four-detector gate (Page-Hinkley, variance-ratio, Jensen-Shannon, Anderson-Darling) determines when to invoke a learned policy, and a Proximal Policy Optimization agent selects a per-window wavelet configuration over a mixed discrete-continuous action space. Unlike prior work, the reward is downstream task utility, not reconstruction fidelity. The denoiser is benchmarked, per drift type and input SNR, against a low-pass moving-average filter, VisuShrink, SureShrink, BayesShrink, and a Wiener filter. Defining the anomaly target on the clean signal and the drift gate on the corruption keeps both stages non-circular.

去噪强化学习网络监控异常检测

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。