# Anomaly Detection in IoT Communication Network Based on Spectral Analysis and Hurst Exponent
## 4 The Methodology of Network Traffic Anomaly Detection Study  
The network traffic pattern for each IoT device differs according to the type of protocol or communication technology used by the manufacturer. Nevertheless, the observation of traffic shows similarities. In order to achieve a precise analysis, it is therefore essential to find common traffic patterns for devices in a given category and to exclude similarities between devices in different categories. Our proposed approach allows us to analyze this problem and identify the device by making full use of hidden correlations and unchanging patterns from the flows of the underlying IoT network. When connected to a network, IoT devices generate traffic (incoming and outgoing) depending on some configuration features and application services. While different devices in a network can use different protocols and transfer data for different purposes, the vast majority of this traffic uses TCP/IP protocols. These packets include network configuration traffic (e.g., Network Time Protocol (NTP) and Domain Name System (DNS)) and routine communication between the device and the server. Therefore, our research was based on TCP/IP traffic analysis. Due to the wide implementation of security protocols such as the Secure Sockets Layer (SSL), Transport Layer Security(TLS), and Privacy Policy, only the packet header can be used to classify traffic. From traffic volume, packet length, network protocols, and traffic direction, i.e., incoming and outgoing, it is possible to separate user packets and control packets. User packets include user data and server-device communication packets (TCP, UDP - User Datagram Protocol, HTTP - Hypertext Transfer Protocol or other multi-layer protocols). Control packets support mainly functional protocol packets such as ICMP (Internet Control Message Protocol), ARP (Address Resolution Protocol), DNS, and NTP packets. The scheme of network traffic anomaly detection based on self-similarity consisted of a few modules: traffic collection, statistical analysis, statistical estimation and anomaly detection (Figure 1). To reduce the impact on normal network usage, when collecting local area network (LAN) traffic, the traffic on the router is reflected on the traffic collection server. Packets received from the router are processed. One can extract some traffic parameters, such as the number of packets and the total length of the packet. The purpose of the study was to observe traffic on the network and determine whether there were long-term dependencies throughout the network operation time and overtime intervals. In order to perform the work of all intercepted packets, we extracted those that had the most significant impact on the network. They were divided into main groups in terms of services and protocols: HTTP, HTTPS (HTTP Secure), Unknown, IP Security (IPsec), DNS, Secure Shel (SSH), and others. The following statistical values of the selected traffic indicators were then calculated. The first step is to check if the traffic is stationary (h \(>\) 0.5). If so, a spectral analysis is performed to compare the current traffic patterns with the adopted safe working model. The values can be used to detect traffic anomalies. The calculated Hurst value is compared with the normal traffic model. If the value of the H parameter differs from the base value in the regular traffic model, the current traffic is considered to be anomalous. It is assumed that the Hurst parameter remains relatively stable. A crucial task in assessing the security of the IoT system is to find the right features of the observed network traffic (directly measurable features) and/or the combination of these features (derivative features). Figure 1: Network traffic anomaly detection scheme. These features should be linked to anomalies. This information can be useful to identify what is happening in the system and how to prevent it.