Abstract: High-quality feature extraction and anomaly detection of large-scale network traffic data is an important basis for network forensics.The key research and implementation of this paper is the data processing and modeling library in network forensics.A method of network traffic anomaly detection based on wavelet analysis was studied to detect pcap files containing two different injection attacks.The study was implemented on the Windows system,and Python language was used to complete the function code.First,the required training data from a large amount of data are extracted,then the features are extracted from trainning data by using wavelet analysis.Finally,the support vector machine is used for classifier training.Thus,two types of anomaly traffic are identified from the mixed traffic containing normal traffic and abnormal traffic.Qualitative and quantitative experimental results show that the method achieves good classification results,and can provide a way for the improvement of network forensics from the two perspectives of feature extraction and classification analysis

Key words: Anomaly detection, Classification analysis, Feature extraction, Network forensics, Wavelet analysis