ANALYSIS OF THE PROCESS OF SELFSIMILARITY OF NETWORK TRAFFIC AS AN APPROACH TO DETECTING CYBER ATTACKS ON COMPUTER NETWORKS

Предложен подход кобнаружению кибератак на компьютерные сети, основанный на выявлениианомалий в сетевом трафике путем оценки свойства самоподобия. Рассмотрены методы выявления долговременной зависимости в фрактальном броуновском движении и реальном сетевом трафике компьютерных сетей. Показано, что трафик телекоммуникационной сети является самоподобной структурой и его поведение близко к фрактальному броуновскому движению. В качестве инструментов при разработке данного подхода были использованы фрактальный анализ и математическая статистика. Анализируются вопросы программной реализации предлагаемого подхода и формирования набора данных, содержащего сетевые пакеты компьютерных сетей. Экспериментальные результаты, полученные с использованием сгенерированного набораданных, продемонстрировали наличие самоподобия у сетевого трафика компьютерных сетей и подтвердили высокую эффективность предлагаемого подхода: он позволяет обнаруживать кибератаки в реальном или близком к реальному масштабе времени. The paper discusses an approach to detecting cyber attacks on computer networks, based on identifying anomalies in network traffic by assessing its self-similarity property. Methods for identifying long-term dependence in fractal Brownian motion and real network traffic of computer networks are considered. It is shown that the traffic of a telecommunication network is a self-similar structure and its behavior is close to fractal Brownian motion. Fractal analysis and mathematical statistics were used as tools in the development of this approach. The issues of the software implementation of the proposed approach and the formation of a data set containing network packets of computer networks are considered. The experimental results obtained using the generated dataset demonstrated the existence of selfsimilarity in the network traffic of computer networks and confirmed the fair efficiency of the proposed approach. The proposed can be used to quickly detect cyber attacks in real or near real time.

An Approach to Detecting Cyber Attacks against Smart Power Grids Based on the Analysis of Network Traffic Self-Similarity

The paper discusses an approach for detecting cyber attacks against smart power supply networks, based on identifying anomalies in network traffic by assessing its self-similarity property. Methods for identifying long-term dependence in fractal Brownian motion and real network traffic of smart grid systems are considered. It is shown that the traffic of a telecommunication network is a self-similar structure, and its behavior is close to fractal Brownian motion. Fractal analysis and mathematical statistics are used as tools in the development of this approach. The issues of a software implementation of the proposed approach and the formation of a dataset containing network packets of smart grid systems are considered. The experimental results obtained using the generated dataset have demonstrated the existence of self-similarity in the network traffic of smart grid systems and confirmed the fair efficiency of the proposed approach. The proposed approach can be used to quickly detect the presence of anomalies in the traffic with the aim of further using other methods of cyber attack detection.

Investigating Network Traffic and Selecting a Matching Mathematical Model

The investigation aimed to study various network traffic types so as to derive a mathematical description not only for a specific type of traffic, but also for the aggregated network traffic. We characterized the main types of data transmitted during network operation and compared the results with the most common mathematical models, that is, Poisson, Pareto, Weibull, exponential and lognormal distributions. We established that regardless of traffic type the volume distribution of data packets transmitted has a "long tail" and is well described by the lognormal distribution model. We evaluated the autocorrelation function, which showed that a long-range dependence characterises virtually all data, which indicates their self-similarity. We also confirmed this conclusion by calculating the Hurst exponent. At the same time, we determined that the degree of self-similarity depends not only on the type of data transmitted, but also on the data ratio in the aggregated network traffic. We selected the following models so as to compare the mathematical descriptions of traffic: classical and fractal Brownian motion, and the AR, MA, ARMA and ARIMA models. The results showed that the fractal Brownian motion model provides the most accurate mathematical description of network traffic

A Note on Wavelet-Based Estimator of the Hurst Parameter

The signals in numerous fields usually have scaling behaviors (long-range dependence and self-similarity) which is characterized by the Hurst parameter H. Fractal Brownian motion (FBM) plays an important role in modeling signals with self-similarity and long-range dependence. Wavelet analysis is a common method for signal processing, and has been used for estimation of Hurst parameter. This paper conducts a detailed numerical simulation study in the case of FBM on the selection of parameters and the empirical bias in the wavelet-based estimator which have not been studied comprehensively in previous studies, especially for the empirical bias. The results show that the empirical bias is due to the initialization errors caused by discrete sampling, and is not related to simulation methods. When choosing an appropriate orthogonal compact supported wavelet, the empirical bias is almost not related to the inaccurate bias correction caused by correlations of wavelet coefficients. The latter two causes are studied via comparison of estimators and comparison of simulation methods. These results could be a reference for future studies and applications in the scaling behavior of signals. Some preliminary results of this study have provided a reference for my previous studies.

A Fractal Mutation Factor Modified Differential Evolution Algorithm

To get better solution by improving the mutation strategy of Differential Evolution algorithm, a fractal mutation strategy is introduced. The fractal mutation factor of the proposed Fractal Mutation factor Differential Evolution (FMDE) algorithm is simulated by fractal Brownian motion with a different Hurst index. The new algorithm is test on 25 benchmark functions presented at 2005 IEEE Congress on Evolutionary Computation (CEC2005). The optimization results of at least 10 benchmark functions are significantly better than the results obtained by JADE and CoDE, and most of the rest of the test results are approximate. This shows that FMDE can significantly improve the accuracy and adaptability to solve optimization problems.