# An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis
## 4 The Methodology of the Study on Network Traffic Anomaly Detection  
An advanced simulation environment has been created for the research. The sophisticated infrastructure allowed us to realize many research scenarios and to measure traffic parameters, including the possibility of its analysis with division into individual network protocols. In order to create and efficiently simulate real network infrastructure, Graphical Network Simulator (GNS3) software was used. This is a free, graphical network emulator, allowing for comprehensive creation and testing of networks built from virtual equipment (a rich library of network devices from leading suppliers such as Cisco, Juniper, and virtual machines). GNS3 can create complex network topologies based on hardware virtualization. The model of designed and tested sophisticated network infrastructure used in the research is shown in Figure 1.  
Figure 1: Network model used for simulation research. Figure 1 shows a detailed diagram of the entire infrastructure under investigation. In the proposed simulation model, one can distinguish the following network infrastructure components:  
* Firewall pfSense: In the presented model, it served as a firewall to filter incoming traffic from the Internet. It was directly connected to an R1 router. The Internet was connected to the network using the network card of the computer on which the network project was created;
* Router R1: vRouter solution was used, which replicates the functionality of hardware routing of internet protocol in the third layer of the ISO/OSI model. In this model, it served as a network gateway for devices in the local network. The network was divided into segments called VRF_A, VRF_B, VRF_C, VRF_SOC, and De-Militarized Zone (DMZ) using Virtual Routing and Forwarding (VRF). VRF is a technology that can partition the router into logical routers, each with a separate routing table. To divide the network into VRF instances for end devices, G0/2 interface has been used. For each subnetwork connected to this interface, a gateway to the LAN has been added, and the dynamic Internet Protocol (IP) address was configured. The VRF_SOC subnetwork was handled by the G0/1 interface. Routing in the network was static;
* Network switches: Two Ethernet switches available in the GNS3 library were used, whose function was limited to transmitting network traffic further. Additionally, the Open vSwitch was used to divide the traffic into individual segments, defined previously in the R1 router. For this purpose, virtual local area networks (VLANS), corresponding to VRF instances, were created. Additionally, a mirroring port has been enabled to intercept traffic from port G0/0 and send it entirely to port G1/1 to monitor network traffic between R1 router and devices in the local network;
* Hosts: A lightweight Linux TinyCore distribution with a Mozilla Firefox preinstalled browser was used to connect to the web interface of network security devices. The VRF_A subnetwork contains a host with Ubuntu Xenial installed, which was used as a platform for installing and testing security. In the VRF_B subnet, there is a host with KaliLinux system, which has many tools to simulate attacks on computer systems. In the VRF_C subnet, there was a VPC, a virtual computer that used minimal resources and had no graphical interface;
* Servers-SRV1: a virtual server located in the DMZ zone, similarly to VPC, had no graphical interface and allowed only the simplest ping operations. In addition, free software like Wireshark [19], Open VAS [20], Snort [21], Kali Linux [22], and Bro [23] were used for the data collection. Snort is a Network Intrusion Detection and Prevention System (IDS/IPS), available under a free license. This system offers a wide range of attack detection mechanisms and enables automatic traffic analysis and the registration of packets passing through networks based on IP/TCP/UDP/Internet Control Messages Protocol (ICMP) protocols.