User behavior analysis based on decomposition of time-stamp sequence

A decomposition method of packet time-stamp sequence is proposed. Firstly, the method samples the information time sequence and utilizes a low-pass filter to find and extract the burst component based on the different attenuation characteristics of different types of sampled signals. Secondly, it uses a traversal and matching method to extract the periodic sub-sequence based on Euclid distance. Finally, it decomposes the encrypted packet sequence into the burst, periodic, and random components. The method need not parse the packet contents, where the periodic component could be used to analyze the user's routine behavior and the burst component could be used for burst abnormality detection. Simulation results show that the method has good decomposition performance.