Statistical Data Analysis of Network Traffic BehaviorUnder DDoS-Attack

Abstract

Due to the recent advancement of informatization in society, there has been a recent increase in the number of attacks by malicious users who steal data and overload the network. The aim of this work is to investigate the statistical characteristics of DDoS traffic, evaluate the robustness of point estimates, and check the data's conformity with known distributions. Constructing a histogram and empirical distribution function; splitting the sample into five random subsamples (  of the volume); calculating point estimates (median, mean, variance, standard deviation); constructing  confidence intervals for the expectation and variance; calculating the trimmed mean; testing the symmetry hypothesis using the asymmetry coefficient; applying the Kolmogorov–Smirnov test and the graphical goodness of fit method with conformity assessment using the  determination coefficient for three distributions: lognormal, Maxwell–Boltzmann, and Laplace. The analysis revealed pronounced right-sided asymmetry and a heavy tail. The sample mean was significantly shifted to the right compared to the median and trimmed mean, which is typical for this type of distribution structure. Although the true mean  fell within the  confidence intervals of all subsamples, the true variance did not fall within any of them, demonstrating the instability of this estimate. All three considered parametric models (lognormal, Maxwell-Boltzmann, and Laplace) were rejected at the significance level of , despite the fact that the Laplace distribution formally demonstrated the highest quality of fit. The study confirmed that DDoS traffic has a complex structure that is not described by classical parametric models. The obtained results substantiate the need to apply complex and nonparametric approaches in data preprocessing and the development of malicious traffic detection systems.