ANALYSIS OF THE PROCESS OF SELFSIMILARITY OF NETWORK TRAFFIC AS AN APPROACH TO DETECTING CYBER ATTACKS ON COMPUTER NETWORKS

2020 ◽  
Author(s):  
И.В. КОТЕНКО ◽  
А.М. КРИБЕЛЬ ◽  
О.С. ЛАУТА ◽  
И.Б. САЕНКО
Keyword(s):  
Brownian Motion ◽  
Computer Networks ◽  
Network Traffic ◽  
Telecommunication Network ◽  
Cyber Attacks ◽  
Self Similarity ◽  
Data Set ◽  
Fractal Brownian Motion ◽  
Self Similar

Предложен подход кобнаружению кибератак на компьютерные сети, основанный на выявлениианомалий в сетевом трафике путем оценки свойства самоподобия. Рассмотрены методы выявления долговременной зависимости в фрактальном броуновском движении и реальном сетевом трафике компьютерных сетей. Показано, что трафик телекоммуникационной сети является самоподобной структурой и его поведение близко к фрактальному броуновскому движению. В качестве инструментов при разработке данного подхода были использованы фрактальный анализ и математическая статистика. Анализируются вопросы программной реализации предлагаемого подхода и формирования набора данных, содержащего сетевые пакеты компьютерных сетей. Экспериментальные результаты, полученные с использованием сгенерированного набораданных, продемонстрировали наличие самоподобия у сетевого трафика компьютерных сетей и подтвердили высокую эффективность предлагаемого подхода: он позволяет обнаруживать кибератаки в реальном или близком к реальному масштабе времени. The paper discusses an approach to detecting cyber attacks on computer networks, based on identifying anomalies in network traffic by assessing its self-similarity property. Methods for identifying long-term dependence in fractal Brownian motion and real network traffic of computer networks are considered. It is shown that the traffic of a telecommunication network is a self-similar structure and its behavior is close to fractal Brownian motion. Fractal analysis and mathematical statistics were used as tools in the development of this approach. The issues of the software implementation of the proposed approach and the formation of a data set containing network packets of computer networks are considered. The experimental results obtained using the generated dataset demonstrated the existence of selfsimilarity in the network traffic of computer networks and confirmed the fair efficiency of the proposed approach. The proposed can be used to quickly detect cyber attacks in real or near real time.

scholarly journals An Approach to Detecting Cyber Attacks against Smart Power Grids Based on the Analysis of Network Traffic Self-Similarity

Energies ◽  
2020 ◽  
Vol 13 (19) ◽  
pp. 5031
Author(s):  
Igor Kotenko ◽  
Igor Saenko ◽  
Oleg Lauta ◽  
Aleksander Kribel
Keyword(s):  
Brownian Motion ◽  
Smart Grid ◽  
Network Traffic ◽  
Telecommunication Network ◽  
Attack Detection ◽  
Cyber Attacks ◽  
Self Similarity ◽  
Smart Power ◽  
Fractal Brownian Motion ◽  
Grid Systems

The paper discusses an approach for detecting cyber attacks against smart power supply networks, based on identifying anomalies in network traffic by assessing its self-similarity property. Methods for identifying long-term dependence in fractal Brownian motion and real network traffic of smart grid systems are considered. It is shown that the traffic of a telecommunication network is a self-similar structure, and its behavior is close to fractal Brownian motion. Fractal analysis and mathematical statistics are used as tools in the development of this approach. The issues of a software implementation of the proposed approach and the formation of a dataset containing network packets of smart grid systems are considered. The experimental results obtained using the generated dataset have demonstrated the existence of self-similarity in the network traffic of smart grid systems and confirmed the fair efficiency of the proposed approach. The proposed approach can be used to quickly detect the presence of anomalies in the traffic with the aim of further using other methods of cyber attack detection.

Investigating Network Traffic and Selecting a Matching Mathematical Model

2020 ◽  
pp. 84-99
Author(s):  
A.V. Chernigovskiy ◽  
M.V. Krivov ◽  
A.L. Istomin
Keyword(s):  
Brownian Motion ◽  
Network Traffic ◽  
Mathematical Description ◽  
Distribution Model ◽  
Volume Distribution ◽  
Self Similarity ◽  
Fractal Brownian Motion ◽  
Data Packets ◽  
Network Operation ◽  
Brownian Motion Model

The investigation aimed to study various network traffic types so as to derive a mathematical description not only for a specific type of traffic, but also for the aggregated network traffic. We characterized the main types of data transmitted during network operation and compared the results with the most common mathematical models, that is, Poisson, Pareto, Weibull, exponential and lognormal distributions. We established that regardless of traffic type the volume distribution of data packets transmitted has a "long tail" and is well described by the lognormal distribution model. We evaluated the autocorrelation function, which showed that a long-range dependence characterises virtually all data, which indicates their self-similarity. We also confirmed this conclusion by calculating the Hurst exponent. At the same time, we determined that the degree of self-similarity depends not only on the type of data transmitted, but also on the data ratio in the aggregated network traffic. We selected the following models so as to compare the mathematical descriptions of traffic: classical and fractal Brownian motion, and the AR, MA, ARMA and ARIMA models. The results showed that the fractal Brownian motion model provides the most accurate mathematical description of network traffic

A Novel Network Traffic Anomaly Detection Based on Multi-Scale Fusion

2011 ◽  
Vol 48-49 ◽  
pp. 102-105
Author(s):  
Guo Zhen Cheng ◽  
Dong Nian Cheng ◽  
He Lei
Keyword(s):  
Anomaly Detection ◽  
False Alarm ◽  
False Alarm Rate ◽  
Network Traffic ◽  
Self Similarity ◽  
Data Set ◽  
Multi Scale ◽  
Traffic Anomaly ◽  
Detection Evaluation ◽  
Better Than

Detecting network traffic anomaly is very important for network security. But it has high false alarm rate, low detect rate and that can’t perform real-time detection in the backbone very well due to its nonlinearity, nonstationarity and self-similarity. Therefore we propose a novel detection method—EMD-DS, and prove that it can reduce mean error rate of anomaly detection efficiently after EMD. On the KDD CUP 1999 intrusion detection evaluation data set, this detector detects 85.1% attacks at low false alarm rate which is better than some other systems.

scholarly journals Proposal of an estimator of the Hurst parameter for a self-similar process representative of the degree of randomness of the recorded traffic in IEEE 802.3-2005 networks

2021 ◽  
Author(s):  
Ginno Millán
Keyword(s):  
Computer Networks ◽  
Memory Structure ◽  
Similar Process ◽  
Hurst Parameter ◽  
Long Term Memory ◽  
Term Memory ◽  
Traffic Stream ◽  
Self Similar

An hypothesis for the existence of a process with long term memory structure, that represents the independence between the degree of randomness of the traffic generated by the sources and the pattern of traffic stream exhibited by the network is presented, discussed and developed. This methodology is offered as a new and alternative way of approaching the estimation of performance and the design of computer networks ruled by the standard IEEE 802.3-2005.

Study of the Impact of Self-Similarity on the Network Node Traffic

1970 ◽  
Vol 111 (5) ◽  
pp. 27-32
Author(s):  
L. Kaklauskas ◽  
L. Sakalauskas
Keyword(s):  
Network Traffic ◽  
Buffer Capacity ◽  
Service Discipline ◽  
Network Node ◽  
Self Similarity ◽  
Packet Losses ◽  
Queue Discipline ◽  
Self Similar ◽  
Stochastically Bounded ◽  
The Impact

The article analyses a stochastically bounded the GI/G/m//N circuit switched network model with packet losses, with stochastic input network traffic, stochastic served network node, and deterministic and finite network node buffer capacity. Max-plus algebra instrumentality is used for the network processes analysis. FIFO tail drop or LIFO tail drop buffer is used. We have established that the average waiting time in the queue had increased when the queue service discipline was FIFO as compared with LIFO, while the offered traffic was Poisson and the served in the node traffic was self-similar. The network traffic is served faster in the network node with the buffer queue discipline LIFO, while the offered traffic is Poisson and its intensity exceeds the served in the node traffic 10 times. Ill. 2, bibl. 24 (in English; abstracts in English and Lithuanian).http://dx.doi.org/10.5755/j01.eee.111.5.350

scholarly journals Optimising Self-Similarity Network Traffic for Better Performance

2020 ◽  
pp. 164-176
Author(s):  
Ikharo A. B. ◽  
Anyachebelu K. T. ◽  
Blamah N. V. ◽  
Abanihi V. K.
Keyword(s):  
Network Traffic ◽  
Network Performance ◽  
Computer Network ◽  
Ann Model ◽  
Performance Measurements ◽  
Self Similarity ◽  
Traffic Modelling ◽  
Backpropagation Network ◽  
Self Similar

Given the ubiquity of the burstiness present across many networking facilities and services, predicting and managing self-similar traffic has become a key issue owing to new complexities associated with self-similarity which makes difficult the achievement of high network performance and quality of service (QoS). In this study ANN model was used to model and simulate FCE Okene computer network traffic. The ANN is a 2-39-1 Feed Forward Backpropagation network implemented to predict the bursty nature of network traffic. Wireshark tools that measure and capture packets of network traffic was deployed. Moreover, variance-time method is a log-log scale plot, representing variance versus a non-overlapping block of size m aggregate variance level engaged to established conformity of the ANN approach to self-similarity characteristic of the network traffic. The predicted series were then compared with the corresponding real traffic series. Suitable performance measurements used were the Means Square Error (MSE) and the Regression Coefficient. Our results showed that burstiness is present in the network across many time scales. The study also established the characteristic property of a long-range dependence (LRD). The work recommended that network traffic observation should be longer thereby enabling larger volume of traffic to be capture for better accuracy of traffic modelling and prediction.

scholarly journals A global comparison of corporate value adjustments to news of cyber-attacks

2020 ◽  
Vol 9 (2) ◽  
pp. 34-44
Author(s):  
Karen M. Hogan
Keyword(s):  
Stock Price ◽  
Cyber Attacks ◽  
Insurance Companies ◽  
Long Term Results ◽  
Long Term Effects ◽  
Short Term ◽  
Individual Country ◽  
Data Set ◽  
Global Comparison

The growing threat of cyber breach has become one of the most feared risks corporations around the world are currently dealing with. This paper uses a methodology similar to Hogan, Olson, and Angelina (2020) to analyze global shareholder value effects of cyber breaches from 1990 to 2019 for five major non-US countries. Cumulative Average Returns (CARs) are calculated using the first notice date to periods of up to 90 days post-announcement to compare short-term and long-term effects of cyber breaches on the stock price. Results for this data set show significant negative returns for US corporations in all windows. Unlike its US counterparts, short-term results for non-US countries show no significant changes to price as a result of cyber breach announcements. Long-term results for the aggregate non-US sample show significance only at the (0,30) window. Individual country long-term analysis shows some significance depending on the event windows, but no common patterns are seen among countries. These results point to differences in how news of a cyber breach, by country, is perceived in the market. The results help explain some of the patterns insurance companies have seen in the reticent buying habits of global companies with respect to cyber insurance.

scholarly journals Estimation of the self-similarity parameter in long memory processes

1970 ◽  
Vol 38 ◽  
pp. 32-37 ◽  
Author(s):  
MMA Sarker
Keyword(s):  
Long Memory ◽  
The Self ◽  
Similar Process ◽  
Long Range Dependence ◽  
Self Similarity ◽  
Similarity Parameter ◽  
Data Set ◽  
Memory Processes ◽  
Long Memory Processes ◽  
Self Similar

Long memory processes, where positive correlations between observations far apart in time and space decay very slowly to zero with increasing time lag, occur quite frequently in fields such as hydrology and economics. Stochastic processes that are invariant in distribution under judicious scaling of time and space, called self-similar process, can parsimoniously model the long-run properties of phenomena exhibiting long-range dependence. Four of the heuristic estimation approaches have been presented in this study so that the self-similarity parameter, H that gives the correlation structure in long memory processes, can be effectively estimated. Finally, the methods presented in this paper were applied to two observed time series, namely Nile River Data set and the VBR (Variable- Bit-Rate) data set. The estimated values of H for two data sets found from different methods suggest that all methods are not equally good for estimation. Keywords: Long memory process, long-range dependence, Self-similar process, Hurst Parameter, Gaussian noise. DOI: 10.3329/jme.v38i0.898 Journal of Mechanical Engineering Vol.38 Dec. 2007 pp.32-37  

scholarly journals Integral-geometric construction of self-similar stable processes

1991 ◽  
Vol 123 ◽  
pp. 1-12 ◽  
Author(s):  
Shigeo Takenaka
Keyword(s):  
Probability Theory ◽  
Brownian Motion ◽  
Natural Science ◽  
Stable Processes ◽  
Self Similarity ◽  
Fractional Brownian Motions ◽  
Stationary Increments ◽  
Construction Of Self ◽  
Self Similar ◽  
Complex Phenomena

Recently, fractional Brownian motions are widely used to describe complex phenomena in several fields of natural science. In the terminology of probability theory the fractional Brownian motion is a Gaussian process {X(t) : t є R} with stationary increments which has a self-similar property, that is, there exists a constant H (for the Brownian motion H = 1/2, in general 0 < H < 1 for Gaussian processes) called the exponent of self-similarity of the process, such that, for any c > 0, two processes are subject to the same law (see [10]).

scholarly journals Statistical research and modeling network traffic

2021 ◽  
Vol 244 ◽  
pp. 07002
Author(s):  
Tatiana Tatarnikova ◽  
Igor Sikarev ◽  
Vladimir Karetnikov ◽  
Artem Butsanets
Keyword(s):  
Network Traffic ◽  
Least Squares Method ◽  
Regression Line ◽  
The Self ◽  
Logarithmic Scale ◽  
Self Similarity ◽  
Statistical Research ◽  
Similarity Parameter ◽  
Real Network ◽  
Self Similar

The self-similarity properties of the considered traffic were checked on different time scales obtained on the available daily traffic data. An estimate of the tail severity of the distribution self-similar traffic was obtained by constructing a regression line for the additional distribution function on a logarithmic scale. The self-similarity parameter value, determined by the severity of the distribution “tail”, made it possible to confirm the assumption of traffic self-similarity. A review of models simulating real network traffic with a self-similar structure was made. Implemented tools for generating artificial traffic in accordance with the considered models. Made comparison of artificial network traffic generators according to the least squares method criterion for approximating the artificial traffic point values by the approximation function of traffic. Qualitative assessments traffic generators in the form of the software implementation complexity were taken into account, which, however, can be a subjective assessment. Comparative characteristics allow you to choose some generators that most faithfully simulate real network traffic. The proposed sequence of methods to study the network traffic properties is necessary to understand its nature and to develop appropriate models that simulate real network traffic.

Sign in / Sign up

Export Citation Format

Share Document