A cognitive multifractal approach to characterize complexity of non-stationary and malicious DNS data traffic using adaptive sliding window

Abstract

This paper presents a cognitive feature extraction model based on scaling and multifractal dimension trajectory to analyze internet traffic time series. DNS (Domain Naming System) traffic time series is considered that contains tagged DNS Denial of Service attacks. The first step of the analysis involves transforming the DNS time series into a multifractal variance dimension trajectory keeping statistical stationarity of data intact. Then features of the trajectory are extracted to remove high variability noise. The extracted set of features indicates the presence of an attack when the denoised trajectory shows increasing variance fractal dimension. This technique is superior in finding changing patterns of a data series due to the presence of noise and denial of service attack because it is not dependent on integer dimensions and mono-scale measurement of variations in data series. Moreover, this technique provides adaptive and locally stationary windows in a highly non stationary data series.