Usage of Modified Holt-Winters Method in the Anomaly Detection of Network Traffic: Case Studies

Table 1

Parameters of the HWT2 model for particular types of traffic.

Network	Protocol	Alpha	Beta	Gamma	Delta	MAE/M	Number of gamma alerts	Number of delta alerts	Number of gamma and delta alerts	Number of Brutlag’s Holt Winters alerts
T3	TCP	0,999497	0,00224	0,487092	0,492391	4,11%	0	0	0	1052
T3	UDP	0,887382	0,007949	0,006263	0	15,45%	1413	2056	717	1377
T3	ICMP	0,999501	0,004789	0,487093	0,492397	8,69%	0	0	0	944
W1	TCP	0,968618	0,005005	0,002687	0,00513	45,92%	918	2193	714	1070
W1	UDP	0,997541	0,001291	0	0,15	30,19%	2743	1358	1047	3293
W1	ICMP	0,8433	0,002486	0	0,2	31,27%	2743	2504	1687	3247
T2	TCP	0,999385	0,00449	0,616195	0,499587	4, 20%	0	0	0	1014
T2	UDP	0,884039	0,000771	3,54E−05	0	15,87%	4562	4685	2806	4562
T2	ICMP	1	0,006488	0,5	0,5	8,53%	0	0	0	1174

Source: own research.