# An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis
## 7 Conclusions  
The problem of characterizing internet traffic is not a challenge that can be solved once and for all. The ever-increasing number of users and the reach of the internet is connected with the constant development of new technologies or their partial change. It is, therefore, necessary to constantly monitor network behavior and to constantly \"learn\" new patterns of traffic and threats. Only constant verification of the assumptions made will allow adjusting the conceptual models proposed by us and correctly describe the real network and its traffic. Since the internet as we know it today is based on the IP protocol, which is managed by the Internet Engineering Task Force (IETF), the use of IP addresses to identify connected devices and traffic along the way has become a completely natural. The research focuses on IP networks and will be further developed with a special focus on the wireless network. The presented results of research using multifractal analysis show significant possibilities to detect both short-term and more intense attacks. The research covered different types of attacks, and the analysis was carried out for the entire network traffic as well as in the scope of different services and protocols. This method of detecting traffic anomalies is effective for network traffic of significant volumes, in particular aggregating different types and communication protocols. With small volumes of abnormal data and short-term attacks, such anomaly detection may be difficult due to embedding such traffic in other protocols, and larger aggregated datasets characterized by a normal specification, thus making these attacks undetectable. That is why we also study the entire network traffic. The traffic decomposition and analysis of specific protocols and services can detect anomalies at a low volume and short duration abnormalities, as well as at long-term changes in traffic pattern and attacks. The fractal analysis helps to calculate and understand the fractal dimension of complex networks, especially anomaly detection. However, it is necessary to describe and characterize many fractal patterns that cannot be described by a single fractal size, which is why we have conducted a multifractal analysis of our network. The multifractal analysis makes it possible to calculate a set of fractal dimensions, especially generalized fractal dimensions. The estimation of Hurst's exponent value showed that long-term dependencies characterize network traffic. In each case, the Long Range Dependencies (LRD) were preserved, which emphasizes the general characteristics and nature of the traffic generated at the nodes. The estimation of Hurst's exponent allows for the analysis of the current course, as well as the prediction of the future trend of data behavior. Thanks to this, it is possible to prepare in advance in an appropriate way to maintain or change the trend. Sudden deviations in the value of the exponent, in relation to the results obtained, may probably be a sign of problems that for network traffic would indicate unusual behavior of the network, possibly associated with a cybercriminal attack. In this article, the authors present issues related to the implementation and validation of the multifractal analysis for the security incidents' detection of the communication system in ICT and IoT systems. As shown in the case of the brute force attack (and some others), an anomaly is indicated by a significantly longer spectrum length of the point dimension on graph characteristics, which may indicate a large number of incorrect login attempts or redundant packets. Other tested protocols showed that the length of the spectra concerning network traffic in which incidents occurred is more extended than during regular operation. Wireless attacks are easy to deploy and can significantly affect network performance. The high vulnerability to forgery attacks allows many other forms of attacks to be implemented.