# Influence of Model and Traffic Pattern on Determining the Self-Similarity in IP Networks
## 1 Introduction  
The IoT environment is a large and complex structure. A considerable number of all kinds of devices connected to the network communicate with each other, generating network traffic. To ensure proper transmission, traffic should be continuously analyzed to detect any anomalies before the loss of continuity of transmission. One of the tools used to assess the characteristics of traffic is the Hurst exponent. It allows for the analysis of the current network state and for the prediction of the future trend in the behavior of data intensity. According to the packet source, specific traffic characteristics allow for predicting the action of the network correctly and thus they appropriately distribute network assets and reach the desired level of service for each network user [1, 2]. Traffic information is also valuable in categories of protection and identification of incidents or other vulnerabilities in the network. The traffic volume of any network may vary according to the time of day, period, cultural events, etc. To record statistical features of real-time traffic, long-term and multifractal dependencies need to be defined, creating a kind of DNA of traffic in the network. Having historical data of the network traffic, we can detect its nature by examining patterns from various work periods of the network by comparing each time window to the determined Hurst coefficient. The mechanisms of traffic anomaly detection require the rapid identification of unforeseen events and the response to them when processing millions of varieties of events. The analysis enables the detection of network traffic anomalies by comparing the results of analyses of regular network operation with the results contained in the database [1, 3]. Our article aimed to determine the applicability of using selected libraries of computing environment R to establish the coefficient of self-similarity. The Hurst coefficientwas used to evaluate traffic behavior and analyze its character. In the following sections of the article, two cases of IoT network traffic were investigated: high and low intensity. Additionally, we generated for selected motion variants spectral regression graphs. The obtained results were verified by Higuchi and Aaggvar methods for different sizes of time windows. The statistical Hurst exponent was compared with standard, smoothed, and Robinson methods. The last section of the article contains the evaluation of the accuracy of the methods. With the development of new services and the spread of the Internet, challenges for network designers are growing, as well as threats such as cyber-attacks. Continuous network operation analysis allows for early detection of all kinds of errors, threats that we generally define as anomalies of network operation. New types of attacks are a significant threat. Hackers use various techniques to bypass current signatures and anomaly detection systems on the basis of intrusion detection systems. In order to detect new threats more effectively and secure the communications network, it is necessary to constantly analyze traffic in order to detect and respond to the anomaly [1]. The proposed method can detect the state of network and system anomalies by calculating the change in the self-similarity value. Until now, we have used the functions implemented in Matlab, Benoit, and Frac Lab [2], and thus here we have instead tried to use the libraries of the R programming environment. R is a free software environment for statistical computing and graphics that is used to determine self-similarity. It compiles and runs on a wide variety of UNIX platforms, as well as on Windows and MacOS. Our goal was to investigate whether the R environment can be used for network traffic analysis and with which effect. Do the models implemented in R produce equivalent results? Our objective was, therefore, to verify the implemented in R methods to determine the H value and its adequacy.