Alexander Hinz: The IP Address Structure is Multifractal

Observed Internet traffic shows a multifractal structure that can be used to differentiate between benign and malicious traffic. These observations are derived in a two-decade old research, which has been used as a basis for prefix-level monitoring in DDoS detection in a recent work. Earlier research suggests that Internet traffic traces in general have a structure that can be approximated by multifractal models and is stable over short times and at a fixed observation site (e.g., access links, ISPs).  Investigations of the structure of source address aggregates (/8, /16, /24) of Internet background radiation found that source addresses tend to form a relatively small number of tight clusters exhibiting multifractal characteristics.

In this talk, we review the key findings and methods of the three seminal papers, as well as recent work that extends prior analyses. Our goal is to reveal the basic insigths and discuss potentials of applying these structural properties in the context of the  AI:AutoImmune project.