# An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis
## 5 Multifractal Analysis of Performed Tests Results
### Simulation of a Brute Force Attack and Its Multifactorial Analysis  
Another group simulated on the presented network infrastructure was brute force attacks. A host-based intruder detection system detected brute force attacks on SSH and FTP servers. The Hydra program started multiple connections to the SSH server using different authentication data, changing them each time until a password could be found. The brute force blocking script consists of two rules. The first one is a command to call a brute force blocking script with a given IP address if the condition is met. The second rule is responsible for effective action in case of detecting a threat in this case of a brute force attack by running a specific command. In the case of the SSH server, the triggered rule searches for any information related to the illegal user, which will appear in every log event. If it is called eight times in one hundred and twenty seconds, the next rule is activated, which informs about the attack and blocks any movement from the attacker for the time specified in the rule, which was set for three minutes to carry out many attempts of the attack. Attack alerts shown in Figure 13 inform about multiple attempts to log into the SSH server by a non-existent user. Additionally, the NIDS system detected a scan associated with the attack. After developing the details of the alert, one can see the source and destination address of the attack.  
Figure 12: The multifractal spectrum of Secure Shell (SSH) traffic during Denial of Service (DoS) attacks.  
Figure 14 illustrates the traffic related to the SSH protocol during a brute force attack. The increased length of the spectrum in the point dimension compared to the case of an ordinary session indicates the high activity of the attacker trying to access the server.  
Figure 15 shows the multifractal spectrum of FTP and TCP traffic generated when establishing a correct connection with the vsftpd server installed on the PC1 host. The characteristics of this spectrum do not show any symptoms associated with a network attack. Figure 16 shows the reaction of the system to an attack on the FTP server.  
Figure 16: Detected brute force attack attempts on the FTP server in Snort.  
Figure 14: The multifractal spectrum of network traffic generated for SSH protocol during a brute force attack on an SSH server.  
Figure 13: Detected brute force attack attempts on the SSH server in Snort.  
Figure 15: The multifractal spectrum of network traffic generated for FTP protocol during a brute force attack.  
Brute force on the FTP server was associated with PAM, a Linux module responsible for the dynamic authentication of applications and services. As before, multiple login attempts were detected, and then scripts blocking connection with the attack source were launched. NIDS also captured packets containing information about the attack and classified them as high priority alerts. Figure 17 illustrates the multifractal spectrum of TCP and FTP packet flow during a brute force attack. The apparent deviation in the fractal dimension may indicate anomalous network behavior related to the attack.  
The information obtained for both attacks allows further action to be taken to protect against brute force. If an attack never fails, but the attacker makes further attempts after being unblocked by the system, the scripts allow the IP address to be placed on a blacklist, which will effectively prevent similar activity in the future. To avoid false alarms and to avoid blocking authorized users, the HIDS system has a whitelist, where trusted IP addresses can be placed.