Fig 1.
Time series of attack frequency w(t) for all IP addresses.
(a) Spatiotemporal representation of attack frequencies w(t) of all IP addresses on a logarithmic scale, where the x-axis and y-axis are, respectively, time t and IP address index from 1 to 491 (top to bottom). The IP region 1–246 is denoted as the aqua background, where each of the four IP regions (19–31, 35–47, 50–130, and 131–191) exhibits a particular attack pattern that is overlayed on the background. The IP region 247–363 possesses an attack pattern that is overlayed on the dark-blue background lying under the entire IP-space. (b) Three-dimensional presentation of the attack frequency w(t) on a logarithmic scale. The “walls” of unity height are not visible on the logarithmic scale, but higher “walls” are visible in the IP region 364–491 [corresponding to the vertical light-blue lines on the bottom dark-blue background in (a)], which actually occur in the entire IP-space but are mixed with other patterns. The time resolution is Δt = 1000 seconds.
Fig 2.
Time series of attack frequency with higher time resolution.
Time range: t = 86200 to 86600. Time resolution: Δt = 10 seconds. (a,b) Two- and three-dimensional representations of the attack frequency w(t) for the entire IP-space on a linear scale, respectively.
Fig 3.
Deterministic attack pattern on different time scales.
For time resolution Δt = 10 seconds and IP region 1–250, (a) deterministic attack pattern in a relatively large time scale: the sloped light-green lines in the IP region 19–31, where the time range is t = 38000 to 42000, (b) enlarged section between the two vertical pink lines in (a) in the time range from t = 39500 to 40000, which provides a time-scale comparison between two types of deterministic attack patterns.
Fig 4.
Deterministic attack pattern of “walls”.
For time resolution Δt = 10−3 second, (a) one type of “wall” attacks over the entire IP space, with each IP receiving one attack. The time delays for the attacks to reach the targeted IP addresses exhibit three distinct values, separating the dots in this panel into three lines. (b) A different type of “wall” attack with different delay, and (c) enlarged section in the small red square in (a). Five consecutive attacks on each IP occurred before the next IP is attacked.
Fig 5.
For time resolution Δt = 10 seconds, ⟨w⟩-σ relations (a) for each IP in the IP space, (b) for IP regions 247–257 and 364–491, and for each IP in the dark-blue background with walls (red circles) and without walls (blue squares), (c) for IP region 258–363 with (red circles) and without (blue squares) walls. The blue dashed lines in (b) and (c) have the slope 1/2.
Fig 6.
Attack frequency deviation within an IP region versus the average at each time unit for (a) the the dark-blue background and (b) IP region 258–363.
The time resolution is Δt = 10 seconds.
Fig 7.
(a) Correlation coefficient matrix associated with the IP space, (b) total number of attacks on an IP address, M (blue), the average time interval between consecutive attacks on an IP, ⟨τ⟩ (red), and the cluster size to which each IP belongs (green). The clustering threshold is set to be 0.7 (somewhat arbitrary). (c) Time series of attack frequency for IP 155 (red), 160 (blue), and 165 (green). All three IP addresses belong to the region of the aqua background without any other overlayed attack patterns. (d) Time series of attack frequency for IP 405 (red), 409 (blue), and 420 (green), which belong to the region of the dark-blue background without any other overlayed attack patterns. One abrupt peak occurs at IP 409, and another at IP 420. The time resolution is Δt = 10000 seconds for all four panels.
Fig 8.
Markov state transition probability matrix (MSTPMs).
For time resolution Δt = 10 seconds, MSTPMs obtained from two randomly selected IP addresses within the corresponding IP region. See the legend of Fig 6(a) for the eight IP regions under different attack patterns: IP addresses (a1,a2) 10 and 33, (b1,b2) 20 and 30, (c1,c2) 40 and 45, (d1,d2) 60 and 120, (e1,e2) 140 and 190, (f1,f2) 200 and 240, (g1,g2) 260 and 360, and (h1,h2) 420 and 490.
Fig 9.
Correlation coefficient matrix associated with the MSTPMs for (a) Δt = 10 seconds and (b) Δt = 100 seconds.
Fig 10.
Predictability calculated from coarse-grained time series.
(a,b) Predictability upper bound Πmax for all 491 IP addresses for various section lengths under time resolutions Δt = 100 seconds and 1000 seconds, respectively, where Πmax values are averaged over all sections. (c) Average Πmax versus section length h for Δt = 100 seconds (red circles) and 1000 seconds (blue squares). (d) Average Πmax of the deterministic (open symbols) and stochastic (closed) attacks versus the section length h for Δt = 100 seconds (red circles) and 1000 seconds (blue squares). In the figure, “D” denotes deterministic and “R” stands for random or stochastic. See text for explanation on why, in the case of Δt = 100, stochastic attacks can have a higher predictability upper bound than deterministic attacks.