Zero-Crossing Analysis of Lévy Walks and a DDoS Dataset for Real-Time Feature Extraction

Abstract

A comparison between the probability similarities of a Distributed Denial-of-Service (DDoS) dataset and Lévy walks is presented. This effort validates Lévy walks as a model resembling DDoS probability features. In addition, a method, based on the Smirnov transform, for generating synthetic data with the statistical properties of Lévy-walks is demonstrated. The Smirnov transform is used to address a cybersecurity problem associated with the Internet-of-things (IoT). The synthetic Lévy-walk is merged with sections of distinct signals (uniform noise, Gaussian noise, and an ordinary sinusoid). Zero-crossing rate (ZCR) within a varying-size window is utilized to analyze both the composite signal and the DDoS dataset. ZCR identifies all the distinct sections in the composite signal and successfully detects the occurrence of the cyberattack. The ZCR value increases as the signal under analysis becomes more complex and produces steadier values as the varying window size increases. The ZCR computation directly in the time-domain is its most notorious advantage for real-time implementations.