The recurrence plot as a tool in the analysis of network traffic anomaly detection

In this paper the dynamical properties of ARP data for anomaly of internet traffic detection are presented. The local network traffic dynamics for single workstation has been observed experimentally on networks with 42 workstations. In the paper RQA (Recurrence Quantification Analysis) measures have been analyzed. Three of them have been explored using RP windowing method: recurrence rate (RR), divergence (DIV) and the longest vertical line (VMAX). The RP windowing algorithm samples the explored ARP time series, as a result each RP window characterized the disintegration of recurrence plots. The RR and VMAX defined the low activity of ARP dataflow. Inversely, the DIV identified the high activity of ARP time series. The authors have proved that both, the recurrence plot technique and the RP windowing method as the tools in the analysis of network traffic anomaly detection are effective and accurate.