A Novel Lévy-Impulse Mixture Based Connection Model for Computer Network Traffic

Computer network traffic features do not always conform with traditional Poisson and Gaussian models. For instance, the α-stable distribution frequently provides a more accurate model for high-volume network traffic. To more accurately characterize SYN traffic, we propose a novel mixture based on measurements from our local network. The proposed Lévy-impulse model utilizes an impulse function to account for a high zero-probability and the Lévy distribution to account for the heavy-tailed features of host-sent SYN packets. We develop a probability density function of the Lévy-impulse model for various window lengths and apply it to real-world data. We then utilize maximum likelihood estimation and real-world network traffic to demonstrate the accuracy of the model. The proposed model demonstrates higher accuracy than traditional models like Poisson or Gaussian for the examined traffic case. Additionally, the relative invariance of the model's fit to the size of the traffic window allows for scalable applications. Ultimately, this Lévy-impulse mixture can serve as a model for normal network traffic to develop improved computer worm detection techniques.