Theses deals with network traffic modeling focused on elaboration by time series analysis. The nature of network traffic is discussed above all http traffic. First three chapters are theoretical, which describes time series and basic models, linear AR, MA, ARMA, ARIMA and nonlinear ARCH. Other chapters define terms like self-similarity and long range dependence. It is demonstrated a failure of conventional models which cannot capture these specific properties of network data traffic. On the basis of study in chapter 6. is closely described the combined ARIMA/GARCH model and its parameter estimation procedure. Applied part of this theses deals with procedure of estimation and fitting the estimation model to observed network traffic. After an estimation a few future values are predicted on the basis of estimated model. These predicted values are consequently compared with real data.

This dissertation addresses Internet background traffic generation and network intrusion detection. It is organized in two parts. Part one introduces a method to model realistic Internet background traffic and demonstrates how the models are used both in a simulation environment and in a lab environment. Part two introduces two different NID (Network Intrusion Detection) techniques and evaluates them using the modeled background traffic. To demonstrate the approach we modeled five major application layer protocols: HTTP, FTP, SSH, SMTP and POP3. The model of each protocol includes an empirical probability distribution plus estimates of application-specific parameters. Due to the complexity of the traffic, hybrid distributions (called mixture distributions) were sometimes required. The traffic models are demonstrated in two environments: NS-2 (a simulator) and HONEST (a lab environment). The simulation results are compared against the original captured data sets. Users of HONEST have the option of adding network attacks to the background. The dissertation also introduces two new template-based techniques for network intrusion detection. One is based on a template of autocorrelations of the investigated traffic, while the other uses a template of correlation integrals. Detection experiments have been performed on real traffic and attacks; the results show that the two techniques can achieve high detection probability and low false alarm in certain instances.