# An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis
## 5 Multifractal Analysis of Performed Tests Results
### Simulation of Exploiting System Vulnerability and Its Multifactorial Analysis
concerns the comparison of all network traffic (all protocols) with that caused only by UDP packets. The flow of UDP packets during regular operation is more predictable, as evidenced by the determination of factor R\({}^{2}\) equal to 0.9785. In contrast, the low value of this factor during a UDP flood attack indicates high unpredictability of network behavior. A clear difference in the approximation lines suggests the occurrence of an attack, most probably at the point (0.39;0.88) marked in the graph. Spectra of incidents take similar shapes in the fractal dimension. Figure 28: Comparison of the multifractal spectrums of the total network traffic (all protocols) and traffic generated for UDP protocol during regular work and UDP flood attack. Figure 21:0 Comparison of the multifractal spectrums of network traffic generated for UDP protocol during normal work and UDP flood attack. Figure 29 shows a comparison of TCP-related traffic during normal operation and flooding with TCP SYN packets. Figure 30 concerns the comparison of the entire network traffic with that generated only by TCP packets. In this attack, the determining factor in both cases is not high. Spectra already at the starting point differs, which indicates that the attacker is sending SYN packets and attempts to respond to the victim. It can be seen that both spectra concerning network traffic during the occurrence of the anomaly take a similar length in the point dimension, which may indicate an increased number of packets per second appearing in the tested flows. Figure 31 shows a comparison of traffic during a regular SSH session and a brute force attack. Figure 32 refers to the full network (all protocols) traffic and SSH traffic during a daily work and brute force attacks. Figure 21:1 Comparison of the multifractal spectrums of the total network traffic (all protocols) and traffic generated for TCP protocol during regular work and TCP SYN flood attack. Figure 21:2 Comparison of the multifractal spectrums of network traffic generated for TCP protocol during regular work and TCP SYN flood attack. The adjustment in both cases was high. The brute force attack is indicated by a significantly longer spectrum length of the SSH brute force characteristics on the graph, which may indicate a large number of incorrect login attempts. Similarly, as in the case of a TCP SYN flood attack, the spectra differ in the starting points, which indicates the occurrence of an attack in the early period of packet traffic. Similarly, as in the previously tested protocols, the length of the spectra concerning network traffic in which incidents occurred is more extended than during regular operation. Figure 33 presents a comparison of the multifractal spectrums of network traffic generated for FTP protocol during a normal work and brute force attacks. The next one, Figure 34, presents the comparison of the multifractal spectrums of the total network traffic (all protocols) and traffic generated for FTP protocol during a regular work and brute force attacks. Figure 21:3 Comparison of the multifractal spectrums of network traffic generated for SSH protocol during normal work and brute force attacks. Figure 21:4 Comparison of the multifractal spectrums of the total network traffic (all protocols) and traffic generated for SSH protocol during normal work and brute force attacks. A deficient determination factor of 0.454 regarding the approximation of the multifractal spectrum during an FTP brute force attack indicates a very high unpredictability of network traffic. The starting points of both spectra begin with an approximate point dimension. In contrast, the difference in the fractal dimension changes rapidly, which indicates that the attack quickly began to affect the number of packets present in the network traffic flow. The FTP attack spectrum shows similar characteristics in the fractal dimension as the full traffic spectrum, including security tests.