# Anomaly Detection in IoT Communication Network Based on Spectral Analysis and Hurst Exponent
## 4 The Methodology of Network Traffic Anomaly Detection Study
As a rule, such devices can fulfill their function as mechanisms of initial traffic analysis for manual log analysis, but they are entirely useless for an automatic reaction. To work with automatic response systems, the anomaly analysis system must be able to provide necessary information to the rules governing reactions. Information about the detection of an anomaly should go to the appropriate agent systems, which should take appropriate action. It can be concluded that each parameter identified and tested by the anomaly recognition system should be associated with an object that is identifiable in network traffic by other security measures, mainly by remotely managed network filters. Network filters operate in different layers of the ISO/OSI model (International Organization for Standardization/Open System Interconnection Reference Model). For each layer, network communication protocols, which uniquely define the form and format of the transmitted information units, are assigned. Based on experience and historical data, the parameters describing the behavior of network traffic can be related to weekdays, seasons, or working hours, as well as the use of characteristic phrases in the content of the transmitted information indicating the so-called \"data leakage.\" When using the Hurst parameter and spectral spectra, or, more precisely their deviations from the standard values, one could consider them as symptoms of unauthorized actions. The proposed method is based on the identification of anomalies in the current time window based on correct samples in the standard profile. For each interval, the value of the exponent was estimated in the first stage in order to determine the character of the motion and to determine the trend. If the similarity was confirmed, in the next step, the tested motion samples were checked for multifractal dependencies. The article used data from the Internet Data Analysis Centre (CAIDA) [30]. The obtained data encompass a set of passive network traffic tracked on a commercial backbone network. The institution mentioned above started collecting data in 2008 and has continued to do so day. Until 2014, data collection took place at the Chicago and San Jose nodes. In the years 2015-2016, traffic was recorded only at the Chicago nodes, but it was moved to New York in 2018. CAIDA analyzes, among other things, types of protocols, and it maintains daily statistics that are available on the organization's website. Figure 2 shows an example of generated statistics that show the number of transmitted packets per second, depending on the type of application. Figure 2: Weekly statistics on network traffic. The latest available downloadable data sets were selected for analysis. The first set consisted of measurements made in 2016. The packets were captured at the Equinix data center in Chicago. The measurements were taken over several days of sessions from January to April. The second set of data came from the Equinix data center in New York. The recording of intercepted traffic also took place on several-day sessions from March to May 2018. To ensure a meaningful comparison of the network traffic dependencies, different time periods were analyzed, and two sets of data were selected for each month. Dataset A (sample A) was related to data transmission at the Seattle-Chicago node for 2016 and the Sao Paulo-New York node for 2018. Dataset B (sample B) refers to data transmission in opposite directions at these nodes. Table 1 contains the specific properties of all traffic samples extracted from the downloaded datasets.