Based on the fractal structure of the large-scale network traffic aggregation

anomalies were analyzed qualitatively and quantitatively from perspective of the global and local scaling exponents.Multi-fractal singular spectrum and Lipschitz regularity distribution were used to analyze the fractal parameters of abnormal flow

trying to identify the relationship between the changes of these parameters and the emergence of anomalies.Experimental results show that the emergence of anomalies has obvious signs on the singular spectrum and Lipschitz regularity distribution.Using this feature

a new multi-fractal-based anomaly detection algorithm and a new detection framework were constructed.On the DARPA/Lincoln laboratory intrusion detection evaluation data set 1999

this algorithm’s detection rate is high at low false alarm rate

which is better than EMERALD.