Models of monitoring of self-like traffic of information and communication networks for attack detection systems

Abstract

Autoregressive, fractal and multifractal models of network self-similar traffic are con-sidered, which allow to form an adequate reference model (template) of "normal" traffic and to detect traffic anomalies in attack detection and prevention systems. Models of fractal Brownian motion and fractal Gaussian noise were considered as models of fractal motions, because they have self-similarity and long-term dependence properties that correspond to the properties of experimental data, as well as the possibility of their analytical interpretation. When evaluating and identifying processes for the implementation of autoregressive models use adaptive filters-approximators, among which there are neural network and neuro-wavelet. The following were used as multifractal models: a multifractal wavelet model with a beta distribution and a hybrid multifractal wavelet model in which the beta distribution is used on a coarse scale and the dis-tribution of point masses on an accurate scale By modeling as a result of adaptation and learning of models, autocorrelation functions, spectra and variances of model signals qualitatively correspond to the graphs of the experimental signal. In addition, the qualitative and numerical values of the characteristics of the model signals generally correspond to the characteristics of the experimental signal. In this case, beta multifractal wavelet models have a smaller error of determination of characteristics than hybrid multifractal wavelet models, and the relative root mean square error of approximation of the experimental signal using a neural network adaptive filter approximator does not exceed 0.046. Statistical verification by non-parametric criterion of signs allowed to establish the adequacy of experimental and model signals with a significance level of 0.01. Further research should be aimed at developing and using predictive models of self-similar traffic in attack detection and prevention systems, which will increase the efficiency of attack detection.