An abnormal IP traffic detection model based on scale-free network

A model of detecting an abnormal IP traffic in a subset of network is described. The model is based on the hypothesis that random sampling subnet are the same probability distribution as the entire network if some conditions are met with, nodes's degree in IP traffic can be processed as a power-law distribution in scale-free network. The model analyzes the power exponent and relations between the anomalous behavior and parameter r. Finally, a test was conducted by the data, some type attacks could be identified exactly. the model provides a new framework for intrusion-detection system.