An Investigation of Power Law Probability Distributions for Network Anomaly Detection

It has been previously determined that SYN packet inter arrival times are conformant with Benford's law, which predicts the frequency of the leading digits in naturally occurring collections of numbers, and suggested that conformity or non-conformity to Benford's law could be used to detect network anomalies. This paper expands upon that suggestion by making three contributions. First, we verify that conformity to Benford's law of inter arrival times is also true for certain types of both TCP and UDP packets. Second, we discover that packet length could also be another alternative to inter arrival times, with the advantage that it follows both Benford's and Zipf's laws, implying its reliability in detecting network traffic anomaly. Finally, we explore the potential application of power laws in the specific detection of denial-of-service (DoS) attacks using both inter arrival times and packet length. Extensive experiments on the MAWI benchmark dataset and two additional datasets support our claims and demonstrate that whilst Benfordian analysis of inter arrival times can identify DoS attacks, the combination of Benfordian and Zipfian analysis of packet length gives more reliable detection.