# Anomaly Detection in IoT Communication Network Based on Spectral Analysis and Hurst Exponent
## 5 Results
### Case of Anomaly Detection  
Figure 7 shows the evaluation of Legendre's spectra for the 2016 sample A extracted from the data collected and the significant deviation for the same data set in the left and right graphs, respectively. When analyzing the graphs, we can see that data transmission in the form of packets showed standard features for this method of generating spectra. All estimates overlapped and slightly differed  
Figure 6: The distribution of the significant deviation spectra (**left graph**) and the measure of value (**right graph**) for the 2018 sample B.  
Figure 7: Distribution of Legendre spectra (**left graph**) and significant deviation spectra (**right graph**) for the 2016 sample A.  
in values, which was related to the dynamic structure of network traffic. However, the general character of this traffic was typical. The discrepancy between the tested samples concerns the series A of February 18, 2016. In this case, the final results of the fractal dimension generated higher values in comparison with the other samples. Nevertheless, all series remained convergent. In the case of a substantial deviation spectrum, some discrepancies could be seen. For the three traffic samples taken in January, March, and April 2016, the traffic flow characteristics were similar. The initial and the final phase of the spectrum had very close values that came down to a characteristic waveform, but these values were not identical, as the difference was only visible in the thousandths or even ten-thousandths of the estimated results. Slight deviations were visible in the middle phase but did not change the nature of the sample. The data recorded on 18 February 2016 showed a deviation from the other values. The beginning and middle course of the spectrum propagation were very similar. In the final phase, there was a faster disappearance of the values concerning the point dimension. The fractal dimension showed very similar estimates concerning the rest of the generated spectra. The difference between the ends of the point dimension of the deviated sample and the others was 0.067. Due to the small deviation, this sample could not be considered an anomaly that would describe this movement as suspicious or infected. Perhaps the sudden change in packet flow characteristics may have been due to other reasons that were not relevant to the stability of the network. For the faster Legendre spectrum measure, the results of the analysis were collected and are presented in Figure 8.  
The estimates had higher values of the fractal dimension in relation to the analyses performed with the use of functions. All spectra showed similar characteristics concerning each other. The initial and final phases differed depending on the data set, but all had one common space for the maximum values of the fractal dimension, in which the spectra almost overlapped. For the sample of 18 February 2016, the initial phase was slightly different from the others, a difference which may have been the reason for the slightly different characteristics of the recorded motion. In the case of sample B, the spectra had a very similar distribution for all the tested samples. The samples from February and March 2016 were a particular case. They had almost the same waveform, clearly differing only in the final phases. The remaining samples did not stand out significantly, falling within a kind of path of the value that was determined by the spectrum. Compared to sample A of this year, the parabolic distribution of the obtained results was less developed. Additionally, in this case, the point dimension shifted to higher values and had a different course in comparison with the Legendre dimensions, as determined by the default function of the determination of the spectra. Figure 8: Legendre spectra obtained for samples A (**left graph**) and B (**right graph**) in 2016, determined by a measure of values. We aimed to automatically compare spectra and identify anomalies. The presented analysis showed anomalies in traffic patterns on February 18 th.