# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
## 4 Methodology and Implementation
### Failure Rate (FR)  
The FR comparison allows us to check \"apples to apples\" on client nodes requesting data exchange to a particular active host, instead of comparing client nodes to all active hosts. This is crucial because not all active hosts are identical in operations, although data exchange from a particular host might be similar to different client nodes. For example, in a real-life scenario, when a computer user cannot connect to a mail server, they will confirm with their colleagues if access is impossible on their computers too. Thus, the FR of all computers trying to connect to the mail server in that subnet will be similar, whereas it would be odd if other computers can connect except one computer. Malicious hosts try maximizing their exploits by attempting sundry connections within a short period. Thus, we stratify normal and anomalous network connections considering the ratio of failed connections \(F_{r}\) to overall connections \(O_{v}\) as the number of connections made within a particular time window \(t_{i}\). If we depict the network with \(k\) number of client nodes as \(C=\{C_{1},C_{2},C_{3},\ldots,C_{k}\}\) and \(m\) number of active hosts as \(H=\{H_{1},H_{2},H_{3},\ldots,H_{m}\}\), a successful TCP connection is confirmed when an \(ACK\) from an active host \(H_{m}\) is received for a particular \(C_{k}\)\(SYN\) request:  
\[BenignConnection_{i}=BC_{i}=SYN\;sent\;by\;C_{i}\;and\;ACK\;received\;from\;H_{m} \tag{5}\]  
Similarly, the failure of a client node requesting a TCP connection is confirmed when there is a _timeout_ response from an active host \(H_{i}\) to a particular \(SYN\) request:  
\[Failure=F_{C_{i}}= \begin{cases}1&\text{if $SYN$ request by $C_{i}$ times out,}\\ 0&\text{otherwise.}\end{cases}  \tag{6}\]  
Overall connections initiated to a particular active host \(H_{m}\) are obtained through:  
\[OverallConnections=O_{v_{C_{i}}}=BC_{i}+F_{C_{i}} \tag{7}\]  
Now, we define the FR \(C_{fr_{1}}\) of client \(C_{1}\) in the network as the ratio of the number of failures in \(C\) from each active host \(H_{i}\) which is  
\[C_{fr_{1}}=\frac{F_{C_{1}}}{O_{v_{C_{1}}}},\;\;\;C_{fr_{2}}=\frac{F_{C_{2}}}{O_ {v_{C_{2}}}},\;\;\;\ldots,\;\;\;C_{fr_{k}}=\frac{F_{C_{k}}}{O_{v_{C_{k}}}} \tag{8}\]  
where \(i=1,2,\ldots,k\). The average FR denoted as \(A_{fr_{i}}\) of all client nodes to \(H_{i}\) in the network is defined as a threshold \(\tau\), which is the ratio of the sum of client FRs to all clients present in the network at a constant time interval \(t_{i}\). \[A_{fr_{i}}(t_{i})=\frac{1}{k}\sum_{j=0}^{k}C_{fr_{j}}(t_{i}) \tag{9}\]  
Threshold \(\tau\) is dynamically determined to effectively distinguish between benign and malicious network connection through \(A_{fr_{i}}\) of all network connections within a predefined timeframe. In our experiment description, Section 5, we will give a sample predefined timeframe. By analyzing historical network traffic data, \(\tau\) is calibrated to reflect the network's typical behavior, ensuring that only significant deviations, which could indicate malicious intent, are flagged. Our adaptive thresholding approach allows FREC-NIDS to maintain high sensitivity to the attack dataset while minimizing false positives. Based on \(\tau\), we compare \(A_{fr_{i}}\) with individual client nodes FRs. A client node \(C_{i}\) is classified as malicious when \(C_{fr_{i}}\) is greater than our threshold \(\tau\) as follows:  
\[C_{fr_{1}}>\tau,\;\;\;C_{fr_{2}}>\tau,\;\;\;\ldots,\;\;\;C_{fr_{2}}>\tau \tag{10}\]However, this is insufficient, as \(C_{f_{k}}>\tau\) cannot be examined in isolation in a networked environment. It is important to examine FRs from all clients in the network to positively identify a malicious client node. We use the comparison in Equation (10) to process respective FR events distances in an empirical distribution function. We assigned the FR of each client as \(p\) independent and identically distributed arbitrary variable set \(X_{i}\in\{X_{1}\gets C_{f_{1}},X_{2}\gets C_{f_{2}},X_{3}\gets C_{ f_{3}},\dots,X_{p}\gets C_{f_{p}}\}\).