# An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis
## 5 Multifractal Analysis of Performed Tests Results
### Simulation of a DoS Attack and Its Multifactorial Analysis  
The first simulation of unusual phenomena in the modeled network infrastructure was to carry out DoS attacks. Attacks related to UDP flood were captured as anomalies in network operation by Bro software. Two attacks of this type were successfully detected and identified during testing. The information gathered shows that the number of packets sent through ports supported by UDP protocol in comparison to other connections increased significantly. The collected data can identify the source and target of the attack. A repeated attempt to respond by the target host has failed, which may indicate a DoS attack. Default Snort rules were not able to detect unwanted activity, so new security rules were added, to send alerts in case of a UDP packet overload. The operation, with new security rules and identified attacks, is shown in Figure 4.  
Figure 5 shows the multifractal spectrum of network traffic, during which one of the UDP flood attacks was detected. This is clearly indicated by the deviation from the standard, presented during normal network operation. Figure 6 shows the multifractal spectrum of traffic generated by TCP packets during a UDP flood attack. In the normal operation, the number of TCP packets transmitted over the network under investigation was higher than in the case of UDP. This may have been due to the need for the authenticated connection of tools with external servers and the use of terminals using SSH protocol or graphical interface using Hyper Text Transfer Protocol Secure (HTTPS). Figure 4: UDP flood attack detected in Snort. Figure 5: The multifractal spectrum of network traffic generated by UDP packets during a UDP flood attack. Another attack analyzed was a TCP SYN attack. It was also detected during simulation by Bro software. Additional alerts in response to this event were also generated by the Snort software, as shown in Figure 7.  
The number of packets transmitted in the network via port 80 significantly exceeded the other connections. There were many sources of network connections, which could indicate that the attacker was changing the IP address after each connection attempt or reconciliation process left. The rule \"_ET DROP Spamhaus DROP Listed Traffic Inbound group_\", informs about attempts to establish a connection, with the host being the target of the attack, which were rejected by system firewalls. Because the number of TCP packets during the normal operation was higher than in the case of UDP, the deviations shown in Figure 8 are small. Nevertheless, they indicate some anomalies, which may indicate two TCP SYN flood attacks detected by network security. Figure 6: The multifractal spectrum of network traffic generated by transmission control protocol (TCP) packets during a UDP flood attack. Figure 7: TCP Synchronize Sequence Numbers (SYN) flood attack detected in Snort. Another attack analyzed was one from the group of ICMP DoS attacks. Snort detected an ICMP flood attack. Alarms generated by the system are shown in Figure 9.  
For more detailed analysis and to increase the level of detection of this type of threat, Snort has added rules to detect a DoS ICMP attack. For additional testing, the IDS engine was changed to Suricata, and the attack was performed again. As you can see in Figure 10, another engine also detected an incorrect packet size and ICMP packet code. Due to the insignificant number of ICMP packets generated during normal conditions, only one multifractal spectrum has been created, showing all the network traffic during an attack, as shown in Figure 11. In the following case, the anomalies of network traffic caused by flooding the device with ICMP packets are presented by an apparent deviation from the norm, which indicates the high intensity of the attack. Figure 8: The multifractal spectrum of network traffic generated by TCP packets during a TCP SYN flood attack. Figure 10: Suricata Intrusion Detection Systems (IDS) alerts for ICMP flood attack.