# Anomaly Detection in IoT Communication Network Based on Spectral Analysis and Hurst Exponent  
[PERSON]  
1 Faculty of Electrical and Computer Engineering, Rzeszow University of Technology,  
al. Powstancow Warszawy 12, 35-959 Rzeszow, Poland; [EMAIL_ADDRESS]  
1 Faculty of Electrical and Computer Engineering, Rzeszow University of Technology,  
al. Powstancow Warszawy 12, 35-959 Rzeszow, Poland; mirekmaz@prz.  
Network traffic monitoring and analysis (NTMA) is a critical element of network management, primarily to ensure the proper functioning of large IoT networks. As the complexity of internet services and the volume of traffic continue to increase, it becomes challenging to design scalable NTMA applications. Appropriate performance models require accurate traffic models that can capture the statistical characteristics of actual activity. This article shows that estimating the value of Hurst's exponent allows for the analysis of current traffic patterns for the prediction of the future trend of data behavior, both of which can help in ensuring security and detecting attacks or other anomalies in network operations. By correctly estimating the Hurst parameter and creating appropriate patterns, it is possible to prepare for disturbing situations and to react to changes in the trends. Sudden deviations in the value of the exponent that concern the obtained base results probably signify problems and testify to the unusual behavior of the network, which is possibly related to cybercrime or network failure. Such traffic analysis methods can be ideal to protect critical data and maintain the continuity of offered internet services [1; 2; 3; 4; 5].  
The characteristics of individual samples, investigated during long-term and multifractal analyses, differ depending on the character of the network traffic. In cases when there are data sets that are storing records of traffic flowing through the tested communication network, it is possible to detect the nature of the traffic by analyzing samples from different periods of the network operation. In this way, by using long-term and multifractal analyses, it is possible to detect the anomalies of network traffic. The results of regular network operation analyses should be consistent with the results contained in the database. In the case of detecting anomalies or performing an attack on a given network, the analysis of samples of the infected network traffic should differ from the analysis of properly flowing traffic. Since the objects in the IoT are directly connected to the unsafe internet, the attacker can easily access the device's limiting resources. Such public access to the internet makes things susceptible to hacking.  
Our article aims to propose a comprehensive and practical introduction to the application of multifractal analysis in the study of traffic in the IoT network. The theoretical basis is defined, and the problems and traps related to the choice of scaling range, minimal regularity, spectrum approximation, and parameter estimation are discussed. It is shown that multifractal analysis is related to the other standard features of network traffic variability. This multifractal analysis aims to provide a global analysis of data variability [6]. Because geometric structures are inherited from the evolution of data over time, multifractal analysis globally measures the local dynamics (or variability) of the analyzed bounded function. This measure is based on the Eh Hausdorf dimension and is referred to as a multifractal spectrum. The multifractal analysis provides powerful tools to understand the complex non-linear nature of time series in different fields [7].