Validation of the statistical characterization of the web server’s network traffic in a university campus as a mechanism of an intrusion detection system

Abstract

This paper presents the results of statistical analysis of network traffic (in its per second) from and to one university web server. Statistical analysis allows to know the hourly traffic trends and to establish a baseline for normal behavior. It documents, in addition, statistical goodness-fit tests results and analysis of variance, which provide elements that enhance the definition of the baseline. Finally, the outcomes are analyzed to determineits usefulness as intrusion detection mechanism or situations or behaviors that could suggest anomalies or atypical traffic.