# Anomaly Detection in IoT Communication Network Based on Spectral Analysis and Hurst Exponent
## 5 Results
### Case of Normal Traffic State  
The analysis of data transmitted at the Chicago-Seattle node in 2016 (direction B) is shown in Figure 3 and Figure 6. The distribution of Legendre's spectra and the spectra of significant deviation are shown in the left and right graphs of Figure 3, respectively. The spectra generated for these packet sets had very similar characteristics. Both the first and the middle phase of the spectra were the same for all types of samples. Differences occurred only at the level of the final values of the fractal dimension. Therefore, these spectra confirmed the self-similar nature of the network traffic, as shown in the form of a time course of the length of packets flowing through the network. The analysis of the spectra determined by the lines did not show any aberration, contrary to the analyzed sample A. All the spectra of significant deviation showed an entirely similar feature, which indicated the similarity of the flowing traffic. Possible anomalies occurring at the node could be immediately detected by a data sample that was strongly distant from the spectra visible on the graph. A detailed analysis of subsequent samples of the 2018 data is presented in Figure 4. In detail, Figure 4 presents the Legendre spectra and the distribution of the significant deviation spectra for the three tested sample A in the left and right graphs, respectively. Figure 3: Distribution of Legendre spectra (**left graph**) and significant deviation spectra (**right graph**) for the 2016 sample B. The Legendre's spectra for these sample sets also had similar estimations. One could see a clear trace of the creation of a path of spectral value values for this data set. By analyzing new samples from other packet tracking series for this node in the future, one will be able to compare new results with those already obtained. If they overlap or the waveform is similar, the database of the nature of the movement will be enlarged. In the case of a sample containing an unusual movement associated with a network attack, the estimation of this spectrum should significantly differ from the path determined by the standard data flow, which will allow the detection of anomalies or threats. Each of the spectra obtained had similar fractal dimension values. They did not show any deviation from the norm, as determined by the resulting path of the significant deviation spectra. The final phase overlapped for all spectra. Slight deviations occurred in the first and middle phases of the waveforms, but all of them were very close to each other. Figure 5 shows the Legendre spectra for the 2018 sample A generated by a faster measurement method and the distribution of the Legendre spectra for the 2018 sample B in the left and right graphs, respectively. Despite the analysis of the data generated at another node, the results showed that the traffic flow was very similar to the set of sample B from 2016. The range of the point dimension, in which all the values of the fractal dimension fell, was also very similar. The characteristics of these spectra did not show any characteristic features. They did not show any significant deviation from each other, which may suggest that the sample data indicated a typical traffic path in which there were no symptoms  
Figure 4: Distribution of Legendre spectra (**left graph**) and large deviation spectra (**right graph**) for the 2018 sample A.  
Figure 5: Legendre spectra for the 2018 sample A of obtained by values determined by measuring values (**left graph**) and distribution of Legendre spectra for the 2018 sample B (**right graph**). associated with a network attack or suspicious packet flow. The significant deviation spectra for sample B taken from the New York-Sao Paulo node are shown in Figure 6 (left graph). The first phases of the spectra began in a similar value area. The subsequent phases of estimation ran in a very similar way, aiming at almost a typical end of the fractal and point dimension.