# Influence of Model and Traffic Pattern on Determining the Self-Similarity in IP Networks
## 7 Comparison of Results  
The presented Hurst exponent calculations for network traffic processes with high and low packet intensity showed a significant discrepancy in the values obtained. Table 6 presents the average Hurst exponent calculated by the hurstexp command for two general network traffic types. Therefore, the discrepancy for high-intensity traffic was 21% in extreme cases and only 13% in low-intensity. It was found that high-traffic network traffic had a Hurst exponent close to 1, which underlines the self-similar nature of traffic. The results for the low-intensity variant confirmed the situation that the processes had the characteristics of the antipersistent movement, in which the Hurst exponent was in the range of 0 \(<\) H \(<\) 0.5. The process tended to return to the average ratio value. These values made frequent turns in the direction of movement. Table 7 shows the values determined using the hurstSpec, hurstBlock commands, and the average values of the RoverS command for true two types of overall network traffic. It was observed that for a process with high network traffic, the values calculated by different methods had a Hurst exponent similar to the value of 1. This confirmed that high-intensity traffic has strong properties of self-similarity and persistent traffic. According to the designated methods, the process with low network traffic had values close to the Hurst exponent of 0.5. This indicates that this process is random but also antipersistent, as shown by previously calculated exponents. The result calculated using the Higuchi method for a process of low intensity can be treated as an error because the result was not close to the value calculated by other methods. In the case of high intensity, the difference in results obtained reached up to 20%, which shows that not all algorithms can be used to assess the characteristics of traffic correctly. In the case of low traffic volumes and random character, \begin{table}
\begin{tabular}{c c c} \hline \hline
**Type of Network Traffic** & **High Traffic** & **Low Traffic** \\ \hline R/S estimation & 0.85 & 0.51 \\ \hline R/S improved estmation & 0.99 & 0.44 \\ \hline Empirical exponent H & 1.03 & 0.46 \\ \hline Improved empirical H & 1.00 & 0.44 \\ \hline Theoretical exponent H & 0.54 & 0.54 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Averaged values of Hurst exponent calculated for two types of network traffic. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Type of Network Traffic** & **High Traffic** & **Low Traffic** \\ \hline Standard & 1.04 & 0.51 \\ \hline Smooth & 1.20 & 0.54 \\ \hline Robinson & 1.00 & 0.58 \\ \hline Scaled R/S Range (RoverS) & 0.83 & 0.51 \\ \hline Aggvar & 0.81 & 0.48 \\ \hline Huguchu & 1.03 & 0.99 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Hurst exponent values for two types of network traffic. the results cannot constitute a reliable assessment. A detailed analysis of selected protocols is presented in Table 8. Figure 15 shows a detailed comparison of the H-factor values for the time window size 1024. The results show that the Hurst values were dependent on the number of packets. The traffic was more stable, and the obtained signatures could be used to analyze traffic anomalies. Unfortunately, as the table and the graph show, the research found that these values were unbelievable, having a small number of packets, and cannot be used to build \"real traffic behavior rules\". The results were averaged and aggregated according to protocols for two types of network traffic intensity. It was found that the Hurst exponent for ARP, DNS, SSDP, and IGMP were similar for both types of network traffic intensity. For these protocols, the Hurst exponent for high traffic was higher by 5-15% than for low traffic. This was due to the number of packages and the measurement time. The values calculated by the R/S estimation method were similar. For improved R/S estimation, the Hurst exponent value increased for DNS in both types of traffic. Empirical values were also similar to different traffic volumes.