DEIM Forum 2016 G3-5

Inference of cooprations on the network based on the DFA
by using a fixed-point observation
Akihiro SHIBATA† and Tadashi MURAKAMI†† Computing Research Center, High Energry Accelerator Research Organization (KEK)
1-1 Oho, Tsukuba, Ibaraki 305-0801 Japan
E-mail: †{Akihiro.Shibata,Tadashi.Murakami}@kek.jp
Abstract By development of the Internet and spread of Internet devices among people, several activity andcommunications in social networks are done through the Internet. Many of activities via the Internet devices areobserved at internet routers as well as access points, and their activities are recorded in the databases. In thistalk, we investigate events at the fixed-point observation such as the access logs at the Internet routers or firewalls,
and study the method to estimate the utilization situation of the Internet servers. From log data of the end-to-end
connection and its service number, for example, we can know the direct utilization. However, it should be impossible
to obtain links such that a pair of the events are caused by the same origin, because data acquisition is limited tothe event passing through the observation point. In order to obtain such information, i.e., the correlation between
events in the log database, we introduce time-series data analysis method, so called, the detrended fluctuation covariance analysis. The signal passing through an observation point are decomposed into signals of several channels,
and activities of the decomposed channels are investigated by using the correlation function of the time-serise data.
In this talk, we examine the method applying to the log-data of the internet connections passing through firewall,and investigate the dynamical property of the usage of the servers and cooperation property between them.
Key words datamining, time seriese data, statistical reasoning
traﬃc flow can be observed in Internet traﬃc. For example,

1. Introduction

the mechanism of power-law correlations in case of sending

Network structure and its dynamical phenomena such

E-mails are investigated in Refs. [12] [13] [14] [15] [16] [17] [18].

The Inter-

Possible origins of these power-law correlations include thenet Protocol (IP) network is a self-organized network withstructure of the Internet, internal mechanisms, and demands

no central control system, in contrast with ordinary com-

for the E-mail server.

as Internet traﬃc are of significant interest.

munication networks such as the telephone network. The

It should be remarked that the dynamical behavior of the

IP network can be expanded self-directively using routers,

Internet traﬃc is determined not only by the direct use of theand communication-signal flows are controlled by the self-

devices but also by the cooperation activity of the Internet

organized adjustment rule.

The data are divided into

servers. The Internet services work out on the communica-

packets, which are transferred by hopping between routers.

tions between the Internet servers. The domain name service

Therefore, the waiting-line or exclusive-control mechanism(DNS), for example, manages the FQDNs (full qualified do-

may lead to a power-law fluctuation in IP traﬃc. In fact,

main name) and IP addresses for a local site, and answers the

such a power-law fluctuation in IP traﬃc is observed [1] [2]query to resolve the address of an Internet server. The DNS[3] [4] [5] just as for real traﬃc flow [6] [7] [8] [9] [11] [10].

also send query to an external DNS to resolve the address at

On the other hand, the social-network activity on the Internet aﬀects the dynamics of the Internet. By the recent

another site. Therefore, the Internet traﬃc is caused by the
mixture of the communications.

spread of the mobile devices among people, many of activi-

In order to study the dynamical behavior of the Inter-ties and communications in social networks are done throughnet traﬃc such as power-law fluctuation and correlation pro-the Internet. Many of activity via the Internet devices are

file between the Internet servers, we introduce the detrended

observed at internet routes as well as access points. The in-fluctuation analysis (DFA) [19] [20]. The DFA is widely usedfluence of network structure such as free network and theto detect long range self-correlation in time-series data such

dynamics of the network such as power-law fluctuation inas the stock price movement and traﬃc flow. Here, we ex-tend the DFA so as to investigate the mixed time-series

Internetdata, which we call detrended fluctuation covariance analysis(DFCA). In this talk, we focus on the cooperative behaviorof the Internet dynamics. Here, we extend the DFA enable

WAN lw wl

to investigate the mixed time-series data. We decompose themixed signal of the Internet traﬃc into the selected channels
associated to the Internet services such as E-mails, web ac-lw

FW (firewall at KEK)

LAN
Internal
subnet1

DMZ

cess, and DNS. By applying the DFCA to the decomposed
channels, we examine the independency or correlation be-lltween the Internet services. We further study the level ofcooperation between DNS servers using the time-series data.

llInternal
subnet2...

ll

This paper is organized as follows. In Section 2., we explain

Figure 1 Sketch of IP traﬃc for our analysis. The network is

the setup of our analysis and data processing for time-serise

divided into the segments WAN, DMZ, and LAN. The

analysis from a database. In Section 3., we describe theFW controls whether the IP traﬃc passes through the
network segment. The blue arrow labeled wl represents

method DFCA. In Section 4., we present analysis in detail.

the connection from WAN to DMZ. The red arrows la-

We investigate the power-law correlations, and then measure

beled lw represent the connections to WAN from LAN

correlation function to investigate cooperation property be-(internal subnets or DMZ). The green arrows labeled

tween the Internet servers. In Section 5., we give summaryll represent the connections between segments in LAN.

and discussion. Finally, we give conclusion.

Connections from WAN to internal subnets and from
DMZ to internal subnets are denied by the FW.

2. Time-series data processing
We investigate correlation and cooperation of categorized

one is conn (connection) which is the number of permitted

events in the Internet traﬃc by using the fixed-point observa-

connections, and the other is flow (data flow) which is thetion at a firewall (FW). The FW divides into three domains,

amount of data transferred. These two types of data are fur-i.e., the Internet (WAN), the intermediate zone (DMZ), andther classified in terms of Internet services (protocols) andlocal area network (internal-LAN). The internal-LAN is fa-

the direction of TCP/IP connections. In terms of the direc-

ther separated into several virtual LANs (subnets) by using

tion of TCP/IP connections, the data are divided into three

the firewall. Figure 1 shows the sketch of network topol-groups labeled by wl, lw, and ll, as shown in Fig. 1.

ogy which we take out data from The FW monitors and filters point-to-point IP communications across these segments,

Time framefrom 4 May 2009 to 10 Jan 2010
through 36 weeks

and it records the logs of all requested TCP/IP connections.
The log records include data such as connecting time, dura-

conn

the number of connections

flow

the amount of data transfer

mail

SMTP (25)Serviceweb

HTTP (80), HTTPS (443)(protocol)dns

DNS (53)

Data typetion, source and destination IP addresses, the port numberof both endpoints, transfer data size, the flag whether theconnection is permitted or not, and so on. Therefore, using
the log data we can reconstruct Internet connections via theothersothers than above

Network

WAN

Internet

zone

LAN

DMZ, internal subnets (VLANs)log file there are many fields for connection, we only use aTransferwlfrom WAN to DMZ (LAN)part of fields.（注 1） We drop the IP address after classification

class

lw

from LAN to WAN

FW in the form of time-series data.
In this paper, we use log data from FW at KEK. In theof segments. Table 1 summarizes the properties of the datallamong DMZ and internal subnets
Table 1 Summary of data used.

used. The LAN denotes the segments including the DMZ
segment just as internal subnets (see Fig. 1). We use the

The label wl indicates the connection from WAN to DMZdata extracted from logs for a 36 weeks period from 4 May(LAN), lw indicates the connection from LAN to WAN, and2009 to 10 January 2010, and we eliminate connections thatll indicates the connection between segment pairs in the LAN

are blocked by the FW and also those from network mon-segments. In terms of services (protocols), we divide the data

itoring systems. We classify the data into two data types:

into selected services such as web: the connection at port 80(HTTP) or 443 (HTTPS), mail : the connection at port 25（注 1）：We get parmission to access and use the classified information

after masking the IP addresses.

(SMTP), dns: the connection at port 53 (DNS), and others:Figure 2 Time-series data ū(k) (n)(k ∈ { mail, web, dns, others }) for the conn-lw channels. The period is from 11 May to 24 May 2009. The number of connections isshown after every 5 min. interval. The connections are superimposed on eachother from bottom to top: mail(blue), web(green), dns(red), and others(gray).

connections at other ports. Therefore, we have 24 channels:

late various channels in Table 1. The aggregation functions{conn, flow } ⊗ {web, mail , dns, others} ⊗ {wl , lw , ll }.

are useful to calculate the histogram of the number of con-

In what follows, we use the notation “(data type)-(service)-

nections in one minute or five minutes, and to classify the(transfer class)” or a portion thereof to represent the cat-transfer class, {wl , lw , and ll } from point-to-point connec-

egorized data, so-called channel, e.g., conn-mail -lw, conn-

tions.

mail, etc. For example, sending an E-mail from LAN to

Fig. 2 shows a part of u(k) (t) for conn for the two-week

WAN is recorded in the channel conn-mail-lw, and its size

period from 11 May to 24 May 2009, where each u(k) (t) ofis recorded in flow-mail-lw, while receiving an e-mail frommail, web, dns, and others is superimposed on the others for

WAN is recorded in conn-mail-wl and its size is recorded ineach five minutes interval. In Fig. 2, we find daily frequen-

flow-mail-wl. In the same way, browsing through KEK fromcies and weekly frequencies. These periodic trends in u(k) (t)the Internet is recorded page by page in conn-web-wl and its

must be eliminated separately.

size is recorded in flow-web-wl.
In this paper, we use RDBMS, Oracle12c, to analyze the3. Methodtime-series data. The RDBMS has fast and strong condition-

The detrended fluctuation analysis (DFA) is originally pre-matching functionality for huge size of data, and various

sented to analyze the non-static data by applying the root

useful functions for data mining.

mean square analysis of a random walk [19], [20].

First, from the FW logs we extract record such as connect-

Let û(t) a mixed time-series signal in a period T and û(k) (t)ing time, a pair of IP addresses of the point-to-point TCP/IP

a decomposed signal classified by the K categories. The

connection, access-permission flag, connection duration, andtime-series dataset {un } is obtained as the time-sliced sig-

data size (see Table 1), and store them into a database as

nal with a period ∆ ̸ t:(k)

the raw data. We have about 10 million of records per day,and about 3 billions of the amount of records in 36 weeks

un =

∑K
k=1

u(k)
n ,

u(k)
n =

∫ tn

û(k) (s)ds,

(1)

tn−1

within permitted connections.
We further invite various technique of the RDBMS towhere we define tn = tn−1 + ∆t and n = 0, 1, , NT = T /∆t.

gain reasonable processing performance such as the table-

To each classified dataset, we apply conventional DFA. We(k)separation technique and the star-schema structure. For example, the FW logs are stored into the daily tables by using
the table-separation technique, without loss of the seamless
access to the tables. With the table-separation, each of thedaily tables has relatively a small number of records in 10
million instead of a whole number in 3 billions. The daily tables have no relations each other and we can issue queries inparallel. Furthermore, with the star-schema structure, eachtable is treated as a fact table and does not have text data

define y-function for each signal, yn :yn(k) =

∫ tn (⟨⟩)û(k) (s) − u(k) ds

t0∑Nt ( (k) ⟨ (k) ⟩),=ut − u
t=1
∫ tn
⟨
⟩
1
1 ∑Nt (k)u(k) =û(k) (s)ds =
ut .
t=1
T t0
Nt

(2)
(3)

⟨
⟩
where we define an average value u(k) . Then, we divide thedirectly such as ”http”, ”permit”, ”tcp”, and so on. The raw

period T into M -divided intervals with period TM = T /M :][(M )(M ) (M )I (M ) := tm , tm+1 with tm = t0 + mTM , m = 1, .., M .

text data are stored into dimension tables that compresses a

For the m-th interval we define a trend function using linear

large-size dimension tables considerably. Consequently, thefunction, ỹm:M (t), which is determined by a least-square fit

computation speed improves considerably and we can calcu-of the data in the m-th interval. Therefore, we obtain the

(k)

(k)

detrended fluctuation function ∆ym;M (t) defined by
(k)

(k)

∆ym:M (t) := y (k) (t) − ỹm;M (t).

WEB SMTP Others ＤＮ S

(4)Therefore, we obtain correlation function between k and k′channel.
′R(k,k ) (TM ) :=

M
∑

∑

(k)

(k′ )

∆ym;M (tn )∆ym;M (tn )

WEB

-

×

×

○

SMTP

×

-

×

○

Others

×

×

-

△

DNS
△
△
△
Table 2 Covariance coeﬃcients for connections. Upper triangle
represents the coeﬃcients for LW channels, while lower(5)

traiangle for WL chnnels. A symble ⃝ stands for theclear correlation relation, and △ stands for the week cor-

m=1 tn ∈I (M )By using variance mode, we measure the power coeﬃcient

relation.

α(k) in the DFA,Thus, the detrended time series data ūQ (t) is given by
F (k) (TM ) := R(k,k) (TM ) ∼ (TM )α(k) .

(6)

The power coeﬃcient α(k) shows the profile of the dynamics in the channel k such as the self-organaized α(k) ≃ 1 or
random. By using the covariance mode, we obtain the information of independent or cooperative. We introduce thenormalized index , i.e., covariant coeﬃcient :′ρ(k,k ) (TM ) := √

R

(k)

(9)

The blue line in Fig.3 shows y-function of detrended weekly
frequency. It shows that both the daily and weekly trends
are eliminated from the original data in the detrended yfunction, i.e., the bumpy curve with the daily and weekly
periods (green curve) is smoothed.

(k,k′ )(TM )√∈ [−1, 1],
F (k) (TM ) F (k′ ) (TM )(k)uQ,n = u(k)n − ũQ (tn mod TQ ).

(7)

Fig. 4 shows the F (k) (TM ) function, Eq.(6), for the webwl, cmail-wl, and dns-lw channels. For each channel, theF -functions are plotted for both the weekly detrended and4. Analysis

the non detrended data:

the aqua and green plots repre-

In this section, we study the correlation between se-sent the non-detrended F -functions for flow and conn, andWe have decomposed channels, {conn,

the red and blue plots represent the weekly-detrended F -flow } ⊗ {web, mail , dns, others} ⊗ {wl , lw , ll }, we havefunctions. The curving disappears from both the weekly-

possible 300 correlation functions, i.e., 24 F -functions anddetrended plots shown in red and blue in Fig.4. We then fit

276 R-functions. However, most of them should vanish, be-

the fitting with a linear function over the whole range of thecause the origins of the fluctuations can be independent. In

weekly-detrended data. Thus, we find power-law fluctuation

this paper, we focus the cooperation of the Internet servers.

in conn-web-lw and flow-web-lw channel.

Note that the RDBMS is useful in the DFA analysis.

4. 2 Covariance and cooperation

lected channels.

SQL enables us complex calculation with complex condition

First, we analyze the conn channels, {conn} ⊗ {web, mail ,matching by using aggregation with multiple indexes, win-dns} ⊗ {wl , lw ,ll }, which exhibit power-law correlations in

dow functions, and conditional expressions, we can further

the DFA. Fig. 5 shows the correlation coeﬃcients, Eq.(7),calculate y-function, Eq.(2), which is integral of u(t) withfor the three directions wl, lw, and ll. For long time scale, we

subtraction of weekly average.

obtain scattered data in the coeﬃcients, which are caused by

4. 1 Variance and self-organized process

the large error in the correlations. In this study, therefore,

We investigate the categorized data by using DFA. Fig.3

we focus on the data of TM < 2 days (≃ 3000 min).

plots the y-functions for the conn-web-lw channel. The green

We obtain vanishing coeﬃcient ρ(web, mail) ≃ 0; there-line represents y-function for the original data. Since we havefore, the activities of web browsing and of sending e-maila daily and weekly periodic-profile, we extract this periodic

are independent. However, we find correlation coeﬃcients,

profile by using a frequency trend-function. We define theρ(dns, mail) and ρ(dns, web), arenonvanishing. These re-frequency trend-function with TQ frequency as the averagesults suggest cooperation between servers and clients in the(k)Internet which is prescribed in the Internet protocols. Weof un function of the interval TQ :summarize the result of correlation in Table 2.

NQ −1

(k)

ũQ (tn ) =

∑

1
(k)
u
,
NQ m=0 n+m(TQ /∆t)(8)(n = 0, · · · , TQ /∆t − 1)

Next, we examine the correlation coeﬃcients between thedns channels to understand in detail the level of cooperation
between DNS servers distributed in the Internet in detail.
Fig.6 shows the correlation coeﬃcients for the dns channels

where TQ denotes the period, i.e., day or week, ∆t is theof three-directions, i.e., ρ(dns-wl, dns-lw), ρ(dns-wl, dns-

sampling time interval, and NQ = T /TQ is the cycle length.

ll), and ρ(dns-lw, dns-ll). We obtain vanishing or very small

Figure 3 y-function, Eq.(2), for web service in conn data from LAN to WAN (conn-weblw ). The green line shows conn-web-lw with non-detrended, and the blue line
shows the same thing but weekly-detrended.

Figure 4 Combination plots of F -function for the web channel.

0.5

0.5

DNS(LW)-SMTP(LW)
DNS(LW)-WEB(LW)
SMTP(LW)-WEB(LW)

0.4

0.3

0.2

0.2

0.1

0.1

0.1

ρ

0.3

0.2

0

0

0

-0.1

-0.1

-0.1

-0.2

-0.2

-0.2

-0.3

-0.3
10

100
time scale (min)1000

DNS(LL)-SMTP(LL)
DNS(LL)-WEB(LL)
SMTP(LL)-WEB(LL)

0.4

0.3

ρ

ρ

0.5

DNS(WL)-SMTP(WL)
DNS(WL)-WEB(WL)
SMTP(WL)-WEB(WL)

0.4

-0.3
10

100
time scale (min)

1000

10

100
time scale (min)1000

Figure 5 Correlation coeﬃcients ρ(TM ) between web, mail, and dns channels classified
by direction wl, lw, and ll. From upper to lower panels are shown the coeﬀcients of the wl-direction, lw -direction, and ll-direction, respectively. For eachdirection, the red points represent ρ(dns, mail), ρ(dns, web), and ρ(mail, web),respectively.

correlation coeﬃcients ρ(dns-wl, dns-ll), which is attributedand dns-ll directions occur at the same time because of theto the DNS servers holding only the data of the local do-cooperation between DNS servers as discussed in the previ-main. However, nonvanishing ρ(dns-wl, dns-lw) and ρ(dns-ous paragraph. While, the nonvanishing coeﬃcient ρ(dns-lw, dns-ll) indicate that the DNS servers cooperate. Thewl, dns-lw) can be caused, for example, by receiving e-mails

nonvanishing coeﬃcient ρ(dns-lw, dns-ll), for example, isfrom the Internet. The DNS query dns-wl is caused by trans-caused by web browsing, i.e., the DNS queries for the dns-lw

ferring e-mail from WAN to LAN, and the mail server maynels, i.e., we consider that the activities of web browsing andmail sending are independent. In contrast, we find nonva-

0.5

DNS(WL)-DNS(LW)
DNS(WL)-DNS(LL)
DNS(LW)-DNS(LL)

0.4

nishing coeﬃcients between dns and mail, and between dns
and web. These results reflect the dynamics of Internet traf-

0.3

fic, i.e., the cooperation between the mail and DNS servers,ρ

0.2

and between the web and DNS servers. We further examined

0.1

the level of the cooperation between DNS servers distributed0over the Internet using covariance coeﬃcients. We find the-0.1

nonvanishing covariance coeﬃcients between the ll and lw di--0.2

rections and between the lw and wl directions. It should be

-0.3
10

100
1000
time scale (min)10000

remarked that these cooperations between Internet servers
are found without additional information such as Internet
server protocols but using time-series data only.
These results are understood as the fact of cooperation be-

Figure 6 Correlation coeﬃcients between dns channels.

Red,green, and blue points represent ρ(dns − wl, dns − lw),
ρ(dns − wl, dns − ll), and ρ(dns − lw, dns − ll), respectively.

tween servers and clients in the Internet which is prescribedin the Internet protocols. For web browsing, for example, anaddress by FQDN（注 2） is used in the URL (see Fig.8). To access to the web server, the IP address of the web server must

send the invert request to resolve a FQDN from the IP address of which transfers the e-mail.
Next, we investigate correlation coeﬃcients between theconn and flow channels. This is a test for the randomnessof data size for each connection. Fig.7 shows the covariancecoeﬃcients between the conn and flow data for the samechannel id, (i.e., the pair of service-id and direction-id suchas dns-ll ). The coeﬃcients for the dns service reveal a strong
correlation between the conn and flow channels, which suggests the data size for each query is the almost same. The
coeﬃcients for the mail service reveal a weak correlation,
which suggests that e-mail size is random. For the web service, we find a strong correlation between the conn and flow
data type compared with that for the mail service. This suggests that the web page size is mostly random, but over thelong run the average web page size is almost the same.

be resolved from the FQDN. Then, the web browser usuallyqueries the IP address for the DNS server of neighbors. Thus,
web browsing causes a query for the DNS server. Whether
the query is recorded in the logging file of the FW depends on
the status of the DNS server. Because DNS servers are distributed databases in which data is hierarchically organized,
only the IP addresses of the local domain are held. If the IP
address is stored in the local database or cached in memory,the DNS server can quickly answer the query. However, if a
DNS server receives the request for an unknown address, itasks another DNS server to resolve the address. This causes
another query for the DNS server, and this request can berecorded in case the query steps over the FW.
The covariance analysis thus detects and classifies the dynamical property of the Internet such as the cooperation between servers and the eﬀect of the social activity via theInternet. Some of the results can be derived from the pro-

5. Summary and Discussion
We investigated IP traﬃc via Internet communication using firewall log. Internet traﬃc is the eﬀect of network dynamics and associated activities of the social network withtocols and the mechanism of the Internet services. However,these results are obtained without using any knowledge ofInternet services in analyzing the time series data.

6. Conclusion

Internet services. Toward this end, we extended the DFA
into the DFCA which allows us to investigate the mixed timeseries signals. We classified IP traﬃc in terms of the type of
IP connection, and decomposed the signal into the channel
signal, (i.e., the channel is classified according to data type,service type, and direction of connection).
Using the covariance analysis, we examined the level of
independence of the sources of the fluctuation and of the

From these results in the DFCA, we arrive at the following
concluding remarks. Using the covariance coeﬃcients for thedetrended fluctuation signals, we can examine the cooperation profile of classified channels. The vanishing correlationcoeﬃcient shows independence of the pair of channels, while
the nonvanishing correlation-coeﬃcient shows the relationship between the channel pairs. Within this analysis, we

cooperation in the Internet traﬃc. We find the vanishing covariance coeﬃcient ρ(mail, web) between web and mail chan-（注 2）：FQDN stands for full qualified domain name, which in layman’s

term is callded Internet address.

1.2
1

1.2

mail-ll conn-flow
mail-lw conn-flow
mail-wl conn-flow

1

0.8

0.6

0.6

0.6

ρ

0.8

0.4

0.4

0.4

0.2

0.2

0.2

0

0

0
10

100
1000
time scale (min)10000

web-ll conn-flow
web-lw conn-flow
web-wl conn-flow

1

0.8
ρ

ρ

1.2

dns-ll conn-flow
dns-lw conn-flow
dns-wl conn-flow

10

100

1000

time scale (min)

10000

10

100

1000

10000

time scale (min)Figure 7 Correlation coeﬃcient between flow and conn channels. The left, middle, andright pannels show the coeﬃcients for dns, mail, and web, respectively. For eachpanel, the red, green, and blue points represent the ll-direction, lw-direction,
and wl-direction, respectively.

DNS server

Web server
http://google.com/

lw(google.com)[3]A: 173.194.126.230

If not cached[2]Q: google.com

WAN
FW (firewall at KEK)LAN

lw[1]Q: google.com

Webbrowserll

DNS server
Local hosts DB(kek.jp)

DNS server
Cached records[4]A: 173.194.126.230

Figure 8 Sketch of the cooperation between DNS servers.

can correctly detect the cooperation between Internet servers
even when using the restricted informations obtained by
fixed-point observation.

Acknowledgments
The authors thank the Computing Research Center, KEK
for granting us to access and use the log data of the FW in
which personal and security information was eliminated.
References[1] V. Paxson and S. Floyd, IEEE/ACM Trans. Networking 3,
226 (1995)[2] I. Csabai, J. Phys. A 27, L417 (1994)[3] M.Takayasu, H.Takayasu and T. Sato, Physica A233 (1996)
824-834[4] Masao Masugi, IEICE technical report. Information networks Vol.104, No.121 (20040611) 7-12
[5] Shin-ichi Tadaki, J.Phys. Soc. Jpn. 76 044001(2007)[6] T.Musha and H.Higuchi, Jpn. J. Appl. Phys. 15 (1976)
1271-1275[7] M.Takayasu, A. Tretyakov and K. Fukuda and H. Takayasu,
in Traﬃc and Granular Flow’97 rd. D.E. Wolf (Springer,
Berlin, 1998) p.57
[8] K.Fukuda, H.Takayasu: Fractals 1 (1993) 916[9] S. Yukawa and M.Kikuchi: J.Phys Soc. Jpn. 65 (1996) 916[10] S.Tadaki, M.Kikuchi, Y.Sugiyama and S. Yukawa: J. Phys.
Soc. 68 (1999) 3110
[11] S.Tadaki, M.Kikuchi, A. Nakayama, K. Nishinari, A. Shibata, Y. Sugiyama and S. Yukawa: J. Phys. Soc. 75 (2006)
0344002[12] J.-P. Eckmann, E. Moses and D. Sergi, Proc. Natl. Acad.
Sci. USA 101, 14333 (2004)[13] A.-L. Barabási, Nature 435, 207 (2005)[14] K.-I. Goh, A.-L. Barabási and Europhys. Lett. 81, 48002(2008)[15] R.D. Malmgren, D.B. Stouﬀer, and A.E. Motter, L.A.N.
Amaral, Proc. Natl. Acad. Sci. USA 105, 18153 (2008)[16] C. Anteneodo, R.D. Malmgren, and D.R. Chialvo, Eur.
Phys. J. B 75, 389 (2010)[17] M. Karsai, K. Kaski, A.-L. Barabási, and J. Kertész, Sci.
Rep. 2, 397 (2012)[18] Y. Matsubara, Y. Hieida, and S. Tadaki, Eur. Phys. J. B,
86 9 (2013) 371.
[19] C.-K. Peng, S.V. Buldyrev, S. Havlin, M. Simons, H.E.
Stanley and A.L. Goldberger, Phys. Rev. E49,1685-1689(1994)[20] C.-K. Peng, S. Havlin, H.E. Stanley and A.L. Goldberger
AL, Chaos, 5(1), (1995) 82-87[21] K. Hu, P.Ch. Ivanov, Z. Chen, P. Carpena, and H.E. Stanley, Phys. Rev. E 64, 011114 (2001)[22] S. Tadaki, Comp. Phys. Commun. 182, 237 (2011)