# An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis
## 5 Multifractal Analysis of Performed Tests Results
### Simulation of Exploiting System Vulnerability and Its Multifactorial Analysis  
The first simulation of exploiting system vulnerability is an attack using a Shellshock vulnerability. This type of attack on a system with the current version of the hash system shell has not produced any results and raises the alarm, indicating an attempted system tampering, visible in Figure 21.  
Figure 22 shows the multifractal spectrum of network traffic related to the HTTP protocol, which is used during a failed attack during the simulation of exploiting Shellshock vulnerability. Multiple unsuccessful attempts have left more packets behind to detect the attack. Figure 21: Shellshock vulnerability attack detected in Snort. Figure 20: Information about the scanned file in Google Rapid Response (GRR). The attacks were carried out using a sensitive version of bash and the Metasploitable system. They were successful, which resulted in unauthorized access to the system resources. Besides this, intrusion detection systems did not detect any threat, which can be seen in the analysis of the spectrum presented in Figure 23. This does not allow us to determine whether there has been a breach of security measures due to its similarity to the spectra, representing network traffic during normal operation. In the case of Structured Query Language (SQL) Injection attack, incorrectly formulated union select queries executed by a web application returned the error and systems responsible for intrusion detection classified the event as an attempted attack, as shown in Figure 24.  
The multifractal spectrum shown in Figure 25 applies to all HTTP traffic generated during SQL Injection attacks. In its characteristics, it is very similar to the spectrum showing a successful Shellshock attack, which also does not allow assessment of whether and when a security breach occurred. Figure 23: The multifractal spectrum of network traffic generated for HTTP protocol during a successful Shellshock attack. Figure 22: The multifractal spectrum of network traffic generated for Hyper Text Transfer Protocol (HTTP) during a failed Shellshock attack. The alert \"_ET WEB_SERVER SQL Errors in http 200 Response_\" in Snort software refers to a login attempt when entering an apostrophe character ('). Entering common usernames did not cause any errors. The OpenVAS software was used to prevent the vulnerabilities described above. It was used to perform a thorough scan of systems and applications on the PC1-Ubuntu and Metasploitable hosts. The scan results shown in Figure 26 show vulnerabilities in the index.php file, the use of which may lead to the release of sensitive data. The detected system vulnerabilities have been classified as potential threats of Medium and Hard levels. These are mainly due to the use of outdated software versions or errors in the application configuration. Recommended solutions to the problems concerned updating outdated applications and removing or restricting access to phpinfo file. The scanner did not detect a vulnerability associated with Shellshock type vulnerability because the sensitive version of bash shell was run from a separate script. In contrast, the default bash on hosts does not have this vulnerability. Effectiveness of Multifractal Analysis in Identifying Network Traffic Anomalies and Security Issues  
To correlate the moment of detection of the abnormality with the deviations appearing in the graphs, a comparative analysis of multifractal spectra was performed for selected types of attacks. Comparative charts with two spectra were added to each of the protocols under study, based on all-day network traffic without incidents and on the day when security tests were conducted. Figure 27 shows a comparison of network traffic related to UDP protocol during regular operation and during an attack. The polynomial approximation was used to generate reference curves. Figure 28  
Figure 26: Scanning results for the system’s vulnerability detected in Snort. Figure 25: The multifractal spectrum during SQL Injection attacks on the web server.