# Anomaly Detection in IoT Communication Network Based on Spectral Analysis and Hurst Exponent
## 2 Literature Review
The system must collect, store and process enormous collections of historical data in a post-mortem analysis. The authors in [17], based on questionnaires, developed guidelines for future work on anomaly detection, conclusions, and research directions. According to the authors of [18], the manual (human-based) handling of anomalies in complex systems is not recommended, and automatic and intelligent handling is the right approach. In the article, the authors presented many case studies, challenges, and possible solutions for the implementation of computerized anomaly detection systems. There are many approaches to the problem of anomaly detection. The authors of [19] presented a method for detecting network anomalies based on a fuzzy cluster. The proposed method consisted of three stages: preprocessing, function selection, and clustering. The performance indicators used were cluster correctness, accuracy, and a false-positive ratio. According to the authors, the proposed method achieved better results in comparison to other methods. The most known models of long-range dependent processes are the fractional motion of Brown (fBm) and fractional autoregressive integrated moving average (FARIMA) [10]. In the context of Ethernet traffic, it should be noted that data are not stationary due to hidden periods, daily cycles, failures, various anomalies, etc. However, it is reasonable to expect that data will be stationary for smaller timescales when network conditions are relatively stable. Thus, Ethernet traffic is stationary at some scales and not stationary at other scales. Random data entry can be a general trend. These trends are the source of the transient state for a random input process. Estimating the Hurst parameter is necessary to detect the presence of LRD in a time series [12]. Internet traffic monitoring is a crucial task for network security. To detect anomalies, the authors of [20] proposed a multidimensional, self-similar model called the fractional operator BrownianMotion (OfBm) for a conventional similarity analysis in bytes and packets. A non-linear regression procedure based on the original branching and boundary solving procedure were developed in order to fully identify the two-dimensional OfBm. The proposed procedure for detecting anomalies of internet traffic used the Hurst exponent vector underlying the modeling of internet data based on OffBm. Cyber-attack technologies are constantly being developed, and the number of new threats is steadily growing. In the article [21], an innovative method of anomaly detection based on the estimation of self-similarity of systems and networks was proposed. As in our article, self-similarity properties, which are characterized by the Hurst parameter, were also used. By using the proposed method, the status of the network and system anomalies was determined through the calculation of the change of similarity value. The effectiveness and efficiency of this approach were developed based on the Defense Advanced Research Projects Agency (DARPA) Intrusion Detection Evaluation dataset created in 1999. A different approach to the detection of anomalies was proposed in [22]. The authors assumed that the time series of traffic flows should be considered a Poisson's non-stationary process related to superstatistical theory. According to the superstatistical theory, a complex dynamic system can have a significant fluctuation of intense magnitude at large time scales, which causes the system to behave as non-stationary and non-linear, which are also features of network traffic flows. This idea provides a new way of dividing transient traffic time series into small stationary segments that can be modeled using Poisson's distribution in sub-second time scales. To distinguish between normal traffic and anomalous traffic, the Hurst parameter was calculated and compared.