# An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis
## 4 The Methodology of the Study on Network Traffic Anomaly Detection
Snort can analyze packet streams, and search for and match suspicious content, as well as detect many attacks and anomalies. OpenVAS is an entirely free and easily accessible framework that acts as a vulnerability scanner. Wireshark can capture and record data packets, as well as their decoding. Thanks to a large number of additions, it can recognize and decode many communication protocols. It is mainly used by network administrators, exclusive services, and hackers to track packages. Kali Linux is a Debian-based Linux operating system distribution based on Debian, intended mainly for security breaches and penetration tests, as well as security audits. Bro software (an Open Source Network Security Monitoring Tool) is not an active security device, like a firewall or intrusion prevention system. Bro is a sensor, hardware, software, virtual, or cloud platform that quietly and unobtrusively observes network traffic. This software interprets what it sees and creates compact, high-fidelity transaction logs, file content, and fully customized output, suitable for manual review on disk or in a more analyst-friendly tool like a security and information event management (SIEM) system. Devices in subnetworks VRF_A, VRF_B, and VRF_C were not able to connect to each other. However, each of these subnetworks could connect to the Internet, DMZ, and VRF_SOC. The DMZ zone could not connect to the Internet. The devices located in the VRF_SOC subnetwork were used to secure and monitor the IT system. They had unlimited access to all resources of the created network. Their characteristics would be presented in the further part of this work. Kali Linux was used as a tool to carry out attacks. The system has a wide range of tools used for penetration tests and security breaches. In order to carry out tests, Kali Linux machine was placed in the VRF_B subnet and allowed to connect to other subnets. After booting, the network interface sent an IP address query to the Dynamic Host Configuration Protocol (DHCP) server, which was captured by IDS and presented as a high-priority alert. The article presents a detailed analysis of network traffic, both in regular operation and during several selected types of network attacks on the security of selected network components and services provided. The first group of the tested attacks will include Denial of Service (DoS) attacks. These attacks are aimed at blocking a computer or network, thus preventing users from accessing their resources. They do this by flooding the target with traffic or sending it information that causes a failure. In both cases, a DoS attack deprives authorized users of the expected service or resource [24]. PC1_Ubuntu was used as the target of the attack, using three types of flood type attacks. The hping3 tool installed on PC2_Kali_Linux host was used to test responses to three types of DoS attacks. The first type of DoS attack is the UDP DoS flood. When a victim receives a UDP packet on a specific port, he first checks if any programs are running that are currently listening to the requests. If no application is receiving packets through this port, replies are sent with an ICMP packet to inform the sender that the destination is unreachable. This type of attack uses a false source IP address, making it difficult to reveal the location of the attacker and potentially saturate them with response packets sent from the victim. As a result of using resources to check and respond to each packet, the attacked target may quickly become overloaded enough to deny service to regular traffic. The second attack is a DoS attack of the TCP Synchronize Sequence Numbers (SYN) type. It consists of sending a large number of SYN packets to a target, to which it responds with SYN/ACK packets, and then leaving the port open, ready to receive an ACK packet from the sender to complete the call reconciliation process. While waiting for an ACK packet that never arrives, the attacker continues to send SYN packets.