# Anomaly Detection in IoT Communication Network Based on Spectral Analysis and Hurst Exponent
## 5 Results
### Network Traffic Stationery and Spectrum Analysis--General Information
This means that the probability of a given trend continued to differ by less than 10%. The average for all data in sample A for 2016 and 2018 was 0.735 (Figure 5). In the case of direction B, a difference between the samples from 2016 and the 2018 packet sets was visible. These discrepancies may have been the result of the influence of different nodes on which the packet transmissions took place. The balanced measurements of [PERSON]'s exponent for the first set of samples were much higher and exceeded 0.7. The average for these samples was 0.747. The average for 2018's data set B was 0.611. The difference between the extreme values for all samples was 0.196. The average was estimated at 0.689, so the traffic was persistent and showed long-term dependencies despite the observed differences. For the traffic flow recorded in 2016 between the Seattle and Chicago nodes, the calculated Hurst exponent value was the same for samples A and B. Much higher discrepancies could be seen between the Sao Paulo and New York nodes. The average for all tested samples was 0.712. Based on the definition of [PERSON]'s R/S estimation, it could be confirmed that network traffic in the tested backbone network had long-term properties. Table 2 presents a summary of the mean values of Hurst's exponent for all tested network traffic samples. In order to see whether there were no disturbances (anomalies) in the network, the samples were subjected to spectral analysis. All samples were analyzed using three methods. Then, the results of spectrum-generating functions were compared with each other in order to determine the multifractal dependencies. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Date of Packets Collection** & **Sample A** & **Sample B** \\ \hline
2016.01.21 & 0.697 & 0.719 \\
2016.02.18 & 0.702 & 0.777 \\
2016.03.17 & 0.736 & 0.753 \\
2016.04.06 & 0.733 & 0.738 \\
2018.03.15 & 0.734 & 0.618 \\
2018.04.19 & 0.787 & 0.581 \\
2018.05.17 & 0.753 & 0.634 \\The first method of analysis was a function of determining the Legendre spectrum. It was a more natural way of analysis, but it is associated with the loss of information. Unlike, for example, finite element methods, spectral methods, the spectral accuracy cannot accurately handle an arbitrary, locally refined grid. The locally refined grid cannot be smoothly mapped to the standard spectral grid. In the general setting, the use of spectrum analysis implies a loss of some information because the Legendre spectrum is always a concave function. It is necessary to use this type of analysis along with the significant deviation approach to make its estimation easier and robust. The second method is the function of estimating the spectrum of significant deviation, which carries more information by forming the determined values and the spectrum itself. To quickly evaluate the Legendre spectra, the third option of determining the spectrum measure was used, a method that allowed for the fastest estimation of the value in comparison with the Legendre spectrum function. Each of the methods of multifractal spectrum analysis presented a different profile of the behavior of the tested network traffic sample. The values generated by the Legendre spectrum for all tested samples were arranged into a standard scheme that characterized the traffic data. This also applied to the broad deviation spectrum. In order to compare all the spectra, they were divided according to the type of spectrum and the node from which they originated.