Loss of self-similarity detection with second order statistical model and multi-level aggregation approach

Abstract Recent studies have shown that malicious packets introduce distribution error and perturb the self-similarity property of network traffic. As a result loss of self-similarity (LoSS) is detected. Previous works on LoSS detection estimate the self-similarity parameter mostly at normal fixed sampling rate such as 10ms or 100ms. However, this is not sufficient to expose the distribution error of self-similarity model effectively hence increases the false alarm rate detection. This paper proposes a multi-level sampling (MLS) approach for self-similarity parameter estimation in order to increase the accuracy of LoSS detection performance. The proposed method defines LoSS with Second Order Self-similarity Statistical (SOSS) model and estimates the self-similarity parameter using the Optimization Method (OM). The method has been tested using simulation of Fractional Gaussian Noise (FGN) traces and FSKSMNet datasets. The simulation results demonstrate that by comparing normal fixed sampling at 100ms with MLS approach, the accuracy of LoSS detection has been increased from 50% to 100% for malicious traces and from none to 17% for legal Internet traffic traces.