In order to articulate the definition of suspicious traffic formal and more succinctly, it’s essential to establish a set of initial notations.

We assume that network traffic is represented by a sequence of stamped IP packets or messages where each one of them is a structure that contains a header and a payload. We suppose that we have access to any field (e.g., IP addresses, ports and protocols) to any non-encrypted header of the network protocols (e.g., IP, TCP and UDP) inside an intercepted traffic.

Definition 1 (Messages). We denote by $ℳ$ the set of messages that could be found in the network traffic.

Stamped messages are called events and are defined as follows:

Definition 2 (Events). We denote by $ℰ$, the set of the possible events built from $ℳ$ as follows:

$\begin{array}{l}e\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=\langle t\mathrm{,}m\rangle \\ t\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=time\\ m\in ℳ\end{array}$

A sequence of stamped events forms a trace.

Definition 3 (Trace). A trace τ over $ℰ$ is defined using the following BNF grammar:

$\begin{array}{l}\tau \mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=ϵ\mathrm{<mi>\; </mi>\; <mo>\; |\; </mo>\; <mi>\; </mi>}e\mathrm{<mi>\; </mi>\; <mo>\; |\; </mo>\; <mi>\; </mi>}e\mathrm{.}\tau \\ e\in ℰ\end{array}$

where $ϵ$ is the empty trace. The “.” represents the chronological order, i.e., if e appears before e' in a trace τ, then necessarily e happened at a previous time than e'.

We introduce the following propositional logic allowing to verify whether an event in a trace respects some conditions. The main purpose of this language is to define specific patterns of messages we are looking for within the trace, such as message having a given source or destination IP addresses or ports.

Definition 4 (Propositional Event Logic). Let $f_n$ be a field name and v be a value, we introduce the Propositional Event Logic (PEL) as follows:

$\begin{array}{l}p\mathrm{,}q\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=\text{true}\mathrm{<mi>\; </mi>\; <mo>\; |\; </mo>\; <mi>\; </mi>}\text{false}\mathrm{<mi>\; </mi>\; <mo>\; |\; </mo>\; <mi>\; </mi>}{f}_n\mathrm{<mi>\; </mi>}op\mathrm{<mi>\; </mi>}v\mathrm{<mi>\; </mi>\; <mo>\; |\; </mo>\; <mi>\; </mi>}p\vee q\mathrm{<mi>\; </mi>\; <mo>\; |\; </mo>\; <mi>\; </mi>}p\wedge q\mathrm{<mi>\; </mi>\; <mo>\; |\; </mo>\; <mi>\; </mi>}\neg p\\ op:==\mathrm{<mi>\; </mi>}|\mathrm{<mi>\; </mi>}\ne \mathrm{<mi>\; </mi>}|\mathrm{<mi>\; </mi>}\le \mathrm{<mi>\; </mi>}|\mathrm{<mi>\; </mi>}\ge \mathrm{<mi>\; </mi>}|\mathrm{<mi>\; </mi>}<\mathrm{<mi>\; </mi>}|\mathrm{<mi>\; </mi>}>\end{array}$

An event e respects a proposition p, and we say that $p\left(e\right)=\text{true}$, if one of the following conditions holds:

$\begin{array}{l}\text{true}\left(e\right)=\text{true}\\ \left(\neg p\right)\left(e\right)=\neg p\left(e\right)\\ \left(p\vee q\right)\left(e\right)=p\left(e\right)\vee q\left(e\right)\\ \left(p\wedge q\right)\left(e\right)=p\left(e\right)\wedge q\left(e\right)\\ \left(f_n\mathrm{<mi>\; </mi>}op\mathrm{<mi>\; </mi>}v\right)\left(e\right)=\left(e@f_n\right)\mathrm{<mi>\; </mi>}o{p}^{\mathrm{<mo>\; ?\; </mo>}}\mathrm{<mi>\; </mi>}v\end{array}$

For instance, to know if (TCP.DestPort = 80)(e), we check if (e@TCP.DestPort) = ^? 80.

This step requires meticulous attention to ensure the approach’s effectiveness is maximized. It’s important to decompose the trace into one or multiple sequences of slices characterized by smooth variations. The end user must have a clear understanding of their activity’s nature to identify instances where sudden changes should not occur. Below, we provide some illustrative examples:

The forthcoming definition introduces a slicing function designed to partition a trace, catering to diverse scenarios and requirements.

Definition 5 (Slicing). Let p be a propositional formula in PEL and τ be a trace in $\mathcal{T}$. We inductively introduce a slicing function ${\mathcal{S}}_p\left(\tau \right)$ as follows:

$\begin{array}{l}{\mathcal{S}}_p\left(ϵ\right)\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=ϵ\\ {\mathcal{S}}_p\left(e\right)\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=\{\begin{array}{ll}ϵ\hfill & \text{if}p\left(e\right)=\text{false}\hfill \\ e\hfill & \text{if}p\left(e\right)=\text{true}\hfill \end{array}\\ {\mathcal{S}}_p\left(e\mathrm{.}\tau \right)\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}={\mathcal{S}}_p\left(e\right)\mathrm{.}{\mathcal{S}}_p\left(\tau \right)\end{array}$

Let $p_1\mathrm{,}\cdots \mathrm{,}{p}_n$ denote propositions. We extend the selection function to operate on sets of sequences of propositions as follows:

$\begin{array}{l}{\mathcal{S}}_{\left\{p_1,\cdots ,p_n\right\}}\left(\tau \right)=\left\{{\mathcal{S}}_{p_1}\left(\tau \right),\cdots ,{\mathcal{S}}_{p_n}\left(\tau \right)\right\}\\ {\mathcal{S}}_{\langle p_1,\cdots ,p_n\rangle }\left(\tau \right)=\langle {\mathcal{S}}_{p_1}\left(\tau \right),\cdots ,{\mathcal{S}}_{p_n}\left(\tau \right)\rangle \end{array}$

If $p\left(i\right)$ is a proposition that depends on i, we use the notation ${\langle p\left(i\right)\rangle }_{sart\mathrm{,}jmp}^{end}$ as an abbreviation of

$\langle p\left(start\right)\mathrm{,}p\left(start+jmp\right)\mathrm{,}\cdots \mathrm{,}p\left(start+n\ast jmp\right)\rangle$

where n is the natural number such that $n\ast jmp\le end$ and $\left(n+1\right)\ast jmp$. For instance:

$\begin{array}{l}{p}_1=\left(\text{T}\ge \mathrm{10.00.00}\right)\left(\wedge \text{T}\le \mathrm{10.00.10}\right)\\ p_2=\left(\text{T}>\mathrm{10.00.10}\right)\left(\wedge \text{T}\le \mathrm{10.00.20}\right)\\ p_3=\left(\text{T}>\mathrm{10.00.20}\right)\left(\wedge \text{T}\le \mathrm{10.00.30}\right)\\ p_4=\left(\text{T}>\mathrm{10.00.30}\right)\left(\wedge \text{T}\le \mathrm{10.00.40}\right)\\ p_5=\left(\text{T}>\mathrm{10.00.40}\right)\left(\wedge \text{T}\le \mathrm{10.00.50}\right)\\ p_6=\left(\text{T}>\mathrm{10.00.50}\right)\left(\wedge \text{T}\le \mathrm{10.00.60}\right)\end{array}$

Example 1 (Selection). Let τ be the trace containing the traffic captured between 10:00:000 and 10:00:052 focusing on IP.Prot as shown by Table 3 .

Let $\phi ={\langle \left(\text{T}\ge \mathrm{10.00.}j\right)\left(\wedge \text{T}\le \mathrm{10.00.}\left(j+10\right)\right)\rangle }_{j=\mathrm{0,10}}^{60}$. When slicing τ using φ, we compute $S_{\phi }\left(\tau \right)$, resulting in the sequence $\langle {\tau }_1\mathrm{,}\cdots \mathrm{,}{\tau }_6\rangle$, as illustrated in Table 4 .

Each slice, derived from the preceding step, undergoes transformation into an element in ${ℝ}^n$ ( $n\ge 1$) by quantifying certain characteristics through a predefined function F. For simplicity, we concentrate on a class of functions F that produce distributions by tallying events adhering to specified conditions, as delineated in the following definition:

Definition 6 (Feature Measuring Function). Let q be a propositional formula in PEL and τ be a trace in $\mathcal{T}$. We introduce a slicing function ${ℱ}_q\left(\tau \right)$ inductively as follows:

$\begin{array}{l}{ℱ}_q\left(ϵ\right)\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=0\\ {ℱ}_q\left(e\right)\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}=\{\begin{array}{ll}0\hfill & \text{if}q\left(e\right)=\text{false}\hfill \\ 1\hfill & \text{if}q\left(e\right)=\text{true}\hfill \end{array}\\ {ℱ}_q\left(e\mathrm{.}\tau \right)\mathrm{<mo>\; :\; </mo>\; <mo>\; :\; </mo>}={ℱ}_q\left(e\right)+{ℱ}_q\left(\tau \right)\end{array}$

Broadly speaking, ${ℱ}_q\left(\tau \right)$ returns the number of packets in τ that satisfy the property q.

We also extend the selection function to operate on both a sequence of propositions $q_1\mathrm{,}\cdots \mathrm{,}{q}_n$ and a set of traces as follows:

$\begin{array}{l}{ℱ}_{\langle q_1,\cdots ,q_n\rangle }\left(\tau \right)=\langle {ℱ}_{q_1}\left(\tau \right),\cdots ,{ℱ}_{q_n}\left(\tau \right)\rangle \\ {ℱ}_q\left(\langle {\tau }_1,\cdots ,{\tau }_n\rangle \right)=\langle {ℱ}_q\left({\tau }_1\right)\cdots {ℱ}_q\left({\tau }_n\right)\rangle \end{array}$

${ℱ}_q\left(\left\{{\tau }_1,\cdots ,{\tau }_n\right\}\right)=\left\{{ℱ}_q\left({\tau }_1\right)\cdots {ℱ}_q\left({\tau }_n\right)\right\}$

Example 2. Let’s examine the trace provided in Example 1. Let $\psi =\langle q_1\mathrm{,}{q}_2\mathrm{,}{q}_3\mathrm{,}{q}_4\rangle$ such that $q_1=\left(\text{IP}\text{.Prot}=1\right)$, $q_2=\left(\text{IP}\text{.Prot}=6\right)$, $q_3=\left(\text{IP}\text{.Prot}=17\right)$ and $q_4=\left(\text{IP}\text{.Prot}\ne 1\right)\wedge \left(\text{IP}\text{.Prot}\ne 6\right)\wedge \left(\text{IP}\text{.Prot}\ne 17\right)$, then when applying the function ${ℱ}_{\psi }$ to the slices ${\tau }_1\mathrm{,}\cdots \mathrm{,}{\tau }_6$ as depicted in Table 4 , the resulting outcomes are as illustrated in Table 5 .

For instance, ${ℱ}_{\psi }\left({\tau }_1\right)=\langle \mathrm{1,3,1,0}\rangle$ indicates that in slice ${\tau }_1$, there is 1 packet with IP.Prot = 1, 3 packets with IP.Prot = 6, 1 packet with IP.Prot = 17, and 0 packets with other IP.Prot values.

The distributions of these slices serve as inputs to algorithms like KL-Divergence, enabling the measurement of traffic divergence across distinct slices. However, in cases where certain events are absent during observation, their frequencies register as zero, posing a challenge for computing KL-Divergence and potentially leading to division by zero errors. To address this issue, we must either explore alternative divergence techniques or slightly adjust the data distribution through methods such as smoothing. The following definition illustrates one of the well-known smoothing techniques.

Definition 7 (Laplace Smoothing). Let $v=\langle v_1\mathrm{,}\cdots \mathrm{,}{v}_n\rangle$ be a sequence of real numbers. We denote by ${\pi }^k\left(v\right)$ the k-Laplace Smoothing Distribution (k-LSD) of a trace and we define it as follows:

${\pi }^k\left(v\right)=\langle \frac{k+v_1}{k+{\displaystyle {\sum }_{i=1}^n{v}_i}}\mathrm{,}\cdots \mathrm{,}\frac{k+v_n}{k+{\displaystyle {\sum }_{i=1}^n{v}_i}}\rangle$

We augment the function $ℱ$ with Laplace smoothing as follows:

Definition 8 (Feature Measuring Function with Smoothing). We denote by ${\widehat{ℱ}}_p$, the smoothed version of ${ℱ}_p$ achieved through the application of the smoothing function ${\pi }^1$. More formally:

${\widehat{ℱ}}_p={\pi }^1\circ {ℱ}_p$

Example 3. By applying ${\pi }^1$ to column 2 of Table 5 , we obtain ${\widehat{ℱ}}_{\psi }\left({\tau }_i\right)$ as shown by column 3 of Table 6 .

When detecting suspicious activities within traffic data, it can be advantageous to prioritize specific positions within the values returned by $\widehat{ℱ}$ in ${ℝ}^n$. For instance, if $\widehat{ℱ}$ yields $\left(v_1\mathrm{,}\cdots \mathrm{,}{v}_n\right)$ where each $v_i$ represents traffic originating from a specific country, these values might be weighted according to the respective country’s reputation in cyberattacks, assigning greater weight to countries with negative reputations. Presently, there’s a lack of a systematic approach to guide end users in determining these weight values. However, we believe that fine-tuning these weights based on intuition could enhance detection capabilities.

The subsequent definition formalizes the concept of weights.

Definition 9 (Weighting Function ω). We denote by ω a weighting function that accepts weights in ${\left({ℝ}^{+}\right)}^n$, a tuple in ${ℝ}^n$, and returns a probability distribution, i.e.: $\omega \mathrm{<mo>\; :\; </mo>}{\left({ℝ}^{+}\right)}^n\times {ℝ}^n\to {\left[\mathrm{0,1}\right]}^n$.

Let $V_1\mathrm{,}\cdots \mathrm{,}{V}_m$ be in ${ℝ}^n$). We extend ω to a set $\left\{V_1\mathrm{,}\cdots \mathrm{,}{V}_m\right\}$ and a sequences $\langle V_1\mathrm{,}\cdots \mathrm{,}{V}_m\rangle$ of tuples as follows:

$\begin{array}{l}\omega \left(\left\{V_1\mathrm{,}\cdots \mathrm{,}{V}_m\right\}\right)=\left\{\omega \left(V_1\right)\mathrm{,}\cdots \mathrm{,}\omega \left(V_m\right)\right\}\\ \omega \left(\langle V_1\mathrm{,}\cdots \mathrm{,}{V}_m\rangle \right)=\langle \omega \left(V_1\right)\mathrm{,}\cdots \mathrm{,}\omega \left(V_m\right)\rangle \end{array}$

The following definition provides an example of ω.

Definition 10. (Product Scalar Weighting Function) We define the scalar product weighting function, abbreviated as spw, as follows: $\begin{array}{l}\text{spw}\mathrm{<mo>\; :\; </mo>}{\left({ℝ}^{+}\right)}^n\times {ℝ}^n\to {\left[\mathrm{0,1}\right]}^n\\ \text{spw}\left(\text{w}\mathrm{,}v\right)=\langle \frac{{\text{w}}_1\times v_1}{\text{w}\mathrm{.}v}\mathrm{,}\cdots \mathrm{,}\frac{{\text{w}}_n\times v_n}{\text{w}\mathrm{.}v}\rangle \end{array}$ where $w\mathrm{.}u$ is the scalar product of the tow vectors w and u, i.e.: $\text{w}.u={\displaystyle \underset{i=1}{\overset{n}{\sum }}}{\text{w}}_i\times v_i$

We extend the function $\widehat{ℱ}$ by incorporating a weighting function as follows:

Definition 11 (Feature Measuring Function with Smoothing and Weighting). Let ω a weighting function. In the sequel, we denote by ${\widehat{ℱ}}_{p\mathrm{,}\omega }$, the weighted version of ${\widehat{ℱ}}_p$ using the weighting function ω. More precisely: ${\widehat{ℱ}}_{p\mathrm{,}\omega }=\omega \circ {\widehat{ℱ}}_p$ and for any trace τ and a weight vector w, we have: ${\widehat{ℱ}}_{p\mathrm{,}\omega }\left(\text{w}\mathrm{,}\tau \right)=\omega \left(\text{w}\mathrm{,}{\widehat{ℱ}}_p\left(\tau \right)\right)$

Example 4. Let’s examine the trace provided in Example 3. Suppose we aim to prioritize packets containing ports not in 1, 6, 17. As an example, we apply the weighting function $\omega =\text{spw}$ with weights $\text{w}=\langle \mathrm{0.2,0.2,0.2,0.4}\rangle$. The results are illustrated in Table 7 .

After abstracting and transforming the traffic into smoothed distributions, the next step involves measuring the divergence between adjacent slices within each sequence. To achieve this, we employ a divergence function such as the KL-Divergence.

Definition 12 (Divergence Function). A divergence measuring function, denoted by Δ, can be any function with the following signature: $\Delta \mathrm{<mo>\; :\; </mo>}{\left[\mathrm{0,1}\right]}^n\times {\left[\mathrm{0,1}\right]}^n\to ℝ$.

Examples of divergence measuring functions are given in Table 8 .

Notice that, since the KL-Divergence, usually denoted by $D_{KL}$, between two distributions $P=\left(p_1\mathrm{,}\cdots \mathrm{,}{p}_n\right)$ and $Q=\left(q_1\mathrm{,}\cdots \mathrm{,}{q}_n\right)$ is not commutative (i.e., $D_{KL}\left(P\mathrm{<mo>\; |\; </mo>\; <mo>\; |\; </mo>}Q\right)\ne D_{KL}\left(Q\mathrm{<mo>\; |\; </mo>\; <mo>\; |\; </mo>}P\right)$ as shown by Equations (1) and (2)), we can consider $\Delta \left(P\mathrm{,}Q\right)=KL\left(P\mathrm{,}Q\right)=D_{KL}\left(P\mathrm{<mo>\; |\; </mo>\; <mo>\; |\; </mo>}Q\right)+D_{KL}\left(Q\mathrm{<mo>\; |\; </mo>\; <mo>\; |\; </mo>}P\right)$ as the divergence value.

$D_{KL}\left(P\left|\right|Q\right)={\displaystyle \underset{i=1}{\overset{n}{\sum }}}{p}_i\times {\log }_2\left(\frac{p_i}{q_i}\right)$(1)

$D_{KL}\left(Q\left|\right|P\right)={\displaystyle \underset{i=1}{\overset{n}{\sum }}}{q}_i\times {\log }_2\left(\frac{q_i}{p_i}\right)$(2)

Example 5. We apply the KL-Divergence to the trace of Example 4. The result is shown by Table 9 .

After quantifying the divergence between successive slices of traces, the next step is to ascertain if significant abrupt changes have occurred. To accomplish this, we estimate the number of clusters generated by the divergence values. If this count exceeds one, we infer that the trace contains suspicious traffic.

Definition 13 (Clustering). Let ${\mathcal{C}}_n{\mathrm{<mo>\; :\; </mo>2}}^{ℝ}\to \text{true}\mathrm{,}\text{false}$ be a clustering algorithm that estimates the optimal number of clusters N associated with a dataset in $2^{ℝ}$. It returns true if the number $N\ge n$, indicating that the threshold for suspicious activity has been surpassed, and false otherwise.

We are particularly interested in ${\mathcal{C}}_2$. When ${\mathcal{C}}_2$ returns true, it indicates that the traffic is considered suspicious. Examples of the ${\mathcal{C}}_2$ function are provided in Table 10 .

Example 6. Let’s apply the K-means algorithm with the Elbow Method to compute ${\mathcal{C}}_2$ on the trace from the previous example, as illustrated in Table 11 .

Now, we have all the necessary ingredients to define a suspicious traffic.

Definition 14 (Suspicious Traffic)

We define $Suspiciou{s}_{\Delta \mathrm{,}{\mathcal{C}}_2}^{\sigma \mathrm{,}\omega }\left(\tau \mathrm{,}\phi \mathrm{,}\psi \mathrm{,}\text{w}\right)$, a generic function designed to detect suspicious traffic within an analyzed trace τ, as follows:

$\boxed{\boxed{Suspiciou{s}_{\Delta \mathrm{,}{\mathcal{C}}_2}^{\omega }\left(\tau \mathrm{,}\phi \mathrm{,}\psi \mathrm{,}\text{w}\right)={\mathcal{C}}_2\left(\Delta \left({\widehat{ℱ}}_{\psi \mathrm{,}\omega }\left(\text{w}\mathrm{,}{\mathcal{S}}_{\phi }\left(\tau \right)\right)\right)\right)}}$

The Suspicious function integrates various analyses, conducted in the sequence depicted in Figure 3 , and returns true if the traffic is deemed suspicious, and false otherwise. It requires three functions, ω, Δ, and ${\mathcal{C}}_2$, as well as four parameters: τ, w, φ, and ψ.

Example 7. Let’s apply the Suspicious function to the trace provided in Example 1 to ascertain if there exists a sudden change. Based on the results shown in Table 11 , where ${\mathcal{C}}_2$ generates more than one cluster, we deduce that:

$Suspiciou{s}_{\Delta \mathrm{,}{\mathcal{C}}_2}^{\omega }\left(\tau \mathrm{,}\phi \mathrm{,}\psi \mathrm{,}\text{w}\right)=\text{true}$

The suspicious traffic is triggered on slice ${\tau }_3$.

An example of an interesting dataset with a real traffic is available at [29] . It contains 21,000 rows and covers the traffics related to 10 workstations with local IP addresses over a period of three months. Half of these local IP addresses were hacked at some point during this period and became members of different botnets and generated abnormal traffic.

A screenshot of a part of the dataset is shown in Figure 4 , where:

We try to detect the infected computer based on the following assumption for each workstation of the network: the nature of traffic may vary across different days of the week. For instance, weekend traffic could differ significantly from that of weekdays. However, when we consider a specific day, such as Monday, there is no compelling reason for it to undergo substantial changes from one week to another. This implies that Monday’s traffic should remain relatively consistent across all weeks. A similar pattern is expected for other days of the week, such as Tuesday, Wednesday, and so forth.

Based on the assumption, we proceed as follows: we segregate the traffic associated with each workstation and day of the week into distinct files. With ten workstations and seven days a week, this results in a total of 70 files. Subsequently, each of these files undergoes analysis to identify any abrupt changes.

Here are the values of the parameters required used within the function GSuspicious allowing to detect suspect traffic.

$\phi ={\displaystyle \underset{\begin{array}{c}1\le i\le 9\\ 0\le j\le 6\end{array}}{\cup }}\left\{p_{i\mathrm{,}j}\right\}$

where

$p_{i\mathrm{,}j}={\langle \left(IP=i\right)\wedge \left(date\mathrm{.}dd=j\right)\rangle }_{j\mathrm{,}j+7}^N$

and $N=21000$ represents the number of events in the trace.

All these fixed parameters will be the input of our Suspicious function to conclude whether the traffic is suspicious or not. This function proceed as follows:

Below, we present the results obtained from the Elbow Method corresponding to the different days and IP addresses.

1) Monday: Based on the analysis of Monday traffic depicted in Figure 5 , we identify five non-suspicious machines (3, 5, 6, 7, and 9) and five suspicious machines (0, 1, 2, 4, and 8).

2) Tuesday: Based on the analysis of Tuesday traffic depicted in Figure 6 , we identify five non-suspicious machines (3, 5, 6, 7, and 9) and five suspicious machines (0, 1, 2, 4, and 8).

3) Wednesday: Based on the analysis of Wednesday traffic shown in Figure 7 , we observe five non-suspicious machines (3, 5, 6, 7, and 9) and five suspicious machines (0, 1, 2, 4, and 8).

4) Thursday: According to the analysis depicted in Figure 8 , we identify five non-suspicious machines (3, 5, 6, 7, and 9) and five suspicious machines (0, 1, 2, 4, and 8) on Thursday.

5) Friday: Based on the analysis presented in Figure 9 , we observe five non-suspicious machines (3, 5, 6, 7, and 9) and five suspicious machines (0, 1, 2, 4, and 8) on Friday.

6) Saturday: According to the analysis shown in Figure 10 , we can identify five non-suspicious machines (3, 5, 6, 7, and 9) and five suspicious machines (0, 1, 2, 4, and 8) on Saturday.

7) Sunday: Based on the analysis presented in Figure 11 , we observed five non-suspicious machines (3, 5, 6, 7, and 9) and five suspicious machines (0, 1, 2, 4, and 8) on Sunday.

Here are the conclusions extracted from Figures 5-11 :

Our approach predicted that 5/10 local IPs are botnets. Actually, only 5/10 local IPs are real botnets. Therefore:

It follows that:

The UNSW-NB15 dataset [30] was generated using the IXIA PerfectStorm tool. It encompasses nine categories of modern attack types and incorporates realistic behaviors of normal traffic. Comprising 49 features across various categories, some of them are illustrated in Figure 12 . Utilized as an attack tool, IXIA dispatches both benign and malicious traffic to different network nodes. A segment of certain fields from this traffic is demonstrated in Table 13 .

The network contains three sub networks as shown by Figure 13 .

1) Sub network1 (server1): contains nodes with source IP addresses from 59.166.0.0 to 59.166.0.9.

2) Sub network2 (Server2): contains nodes with source IP addresses from 175.45.176.0 to 175.45.176.3.

3) Sub network3 (Server3): contains nodes with source IP addresses from 149.171.126.0 to 149.171.126.19.

Subnetwork 1 (servers1) and subnetwork 3 (server3) are configured to exhibit normal traffic patterns, whereas subnetwork 2 (server2) is associated with abnormal or malicious activities.

We employ our approach across various source IP addresses within all subnetworks. Our assumption is that the nature of the outbound traffic should not undergo sudden changes.

Below are the values of the required parameters used within the Suspicious function for detecting suspicious traffic:

UDP.SourcePort

Below, we present the results obtained from the Elbow Method corresponding to the different subnetworks (servers).

1) Sub network1 (Server1): the Source IP addresses from 59.166.0.0 to 59.166.0.9: shown in Figure 14 .

2) Sub network2 (Server2): Source IP addresses from 175.45.176.0 to 175.45.176.3: shown in Figure 15 .

3) Sub network3 (Server3): Source IP addresses from 149.171.126.0 to 149.171.126.19: shown in Figure 16 .

From Figure 14 , the maximum distortion value for subnetwork 1 (server1) is above 8. In Figure 15 , the maximum distortion value for subnetwork 2 (server2) exceeds 80. Meanwhile, in Figure 16 , the maximum distortion value for subnetwork 3 (server3) is above 70, but for only one IP address, whereas more than 20 IP addresses have a distortion value of zero.

Based on these findings, our approach predicts that subnetwork 2 (server2) is suspicious, as it exhibits abnormal or malicious activities in the network traffic. Therefore:

It follows that:

Below are the values of the required parameters used within the Suspicious function for detecting suspicious traffic:

UDP.SourcePort

Below, we present the results obtained from the Elbow Method for different subnetworks (servers).

1) Sub network1 (Server1): IP source addresses from 59.166.0.0 to 59.166.0.9 shown in Figure 17 .

2) Sub network2 (Server2): IP source addresses from 175.45.176.0 to 175.45.176.3 shown in Figure 18 .

3) Sub network3 (Server3): IP source addresses from 149.171.126.0 to 149.171.126.19 shown in Figure 19 .

From Figure 17 , the maximum distortion value for subnetwork 1 (server1) is above 4. In Figure 18 , the maximum distortion value for subnetwork 2 (server2) exceeds 2. Meanwhile, in Figure 19 , the maximum distortion value for subnetwork 3 (server3) is above 0.008, but only for one IP address, while more than 20 IP addresses have a distortion value of zero.

Based on these findings, our approach predicts that subnetworks 1 (server1) and 2 (server2) are suspicious, as they exhibit abnormal or malicious activities in the network traffic. Therefore:

It follows that:

Table 14 resumes the main features of the proposed approach. Although it has shown the best detection rate (100%), our experimental dataset remains small and we need to apply it on further representative datasets to have better precision on this parameter and other metrics.