# Influence of Model and Traffic Pattern on Determining the Self-Similarity in IP Networks
## 2 Literature Review  
Similarity and fractals are concepts initiated by [PERSON] [3]. Self-similarity can be related to \"groups\", being objects of constant appearance in different scales. For statistical groups, it is the probability density that is reproduced on each scale. The dynamic fractal, however, is generated by a low-dimensional dynamic system with chaotic features. The study of traffic self-similarity can be divided into four categories: measurement-based traffic modeling, physical modeling, queuing analysis, and traffic control and resource availability [3; 4]. The most commonly employed techniques of Hurst estimation, however, are R/S statistics as a time-scale function, rescaling process variance as a time-scale function, and absolute value method [5]. The article [6] presents a technique for discovering network irregularities using a fuzzy cluster. The available studies have already analyzed in detail the properties of self-similarity in a different system and network environments, confirming that traffic in IP networks is self-similar. On the basis of this fact, our intention was to show whether the available tools can actually be an alternative for determining Hurst values. The study of self-similarity in computer networks was demonstrated by [PERSON] et al. [3] and [PERSON] et al. [7]. They analyzed the self-similarity of Ethernet traffic. There are many other types of systems that have self-similarity properties, such as wide-area traffic [8], World Wide Web traffic [9], ATM traffic [10], and peer-to-peer (P2P) traffic [11]. Many studies have shown that changes in Hurst parameters can be used for intrusion detection. According to [PERSON] et al. [12], changing the Hurst parameter reduces high false positive and negative rates by setting the minimum change in the Hurst parameter as an intrusion indicator. [PERSON] and [PERSON] [13] proposed an approach to achieving high sensitivity by using the self-immunity properties in network traffic. In the article [14], a multidimensional, self-similarity model, the fractional operator Brownian-Motion (OfBm), was proposed for common similarity analysis in bytes and packets. A different attempt to detect the abnormalities was proposed in [15]. The authors presumed that the traffic flow time series should be regarded as [PERSON]'s non-stationary process related to the super static theory. In the article [16], a systematic literature review (SLR) of the Intrusion Detection Systems (IDSs) in the IoT environment was presented. Then detailed categorizations of the IDSs in the IoT (anomaly-based, signature-based, specification-based, and hybrid), (centralized, distributed, hybrid), (simulation, theoretical), and (denial of service attack, Sybil attack, replay attack, selective forwarding attack, wormhole attack, black hole attack, sinkhole attack, jamming attack, false data attack) were also provided using standard features. The hypothesis of the existence of processes with long-term memory structure, which represents the independence between the degree of randomness of the traffic generated by the source and the pattern of the traffic stream presented by the network, is confirmed by the authors in [17]. In their work, they presented a methodology that is a new and alternative approach to the estimation of performance and design of computer networks governed by the IEEE 802.3-2005 standard. Long-term dependencies and similarity are the main characteristics of internet traffic. The article [18] proposes a method of the self-domain estimator, which is based on the analysis of fundamental principles (PCA), for estimation of H coefficient. The PCA-based method (PCAbM) uses the progression of eigenvalues that are obtained from the autocorrelation matrix. The results showed that the analysis process is only reliable if the process is long-range-related (LRD), i.e., H is more significant than 0.5. In some cases, such as Gigabit Ethernet, a network can deliver packets faster than a network management subsystem can process them.