Take the 2-minute tour ×
Mathematics Stack Exchange is a question and answer site for people studying math at any level and professionals in related fields. It's 100% free, no registration required.

I have the following situation. I'm studying how malicious host on the internet choose their victims. I must discover if a number of host are acting an in independent way or not. I'm using an hypothesis testing approach:

  • The null hypothesis is that the host scan the internet in a independent fashion
  • The alternative hypothesis is that they scan coordinately

Stating that the first is true (independent scan) we can calculate the distribution of the number of destination ip addresses that receive no scanning. My question is, given that distribution how can I prove that the host scan in an independent fashion? In particular, I am observing a certain number of ip addresses. From this observation I can say what is the number of addresses that have not received any scanning. Using only that number and the given distribution can I use some type of test to prove the null hypothesis?

Another idea was to divide the addresses I'm observing in a series of groups and use the chi square goodness fit test. Do you think that this approach will be formally correct?

share|improve this question
    
Any reason you think it is not correct? –  picakhu Nov 30 '11 at 15:41
    
Actually not but I wanted to be sure of it. Also maybe there are simpler approaches. Now I'm wondering how could I evaluate the expected number of addresses that not receive any scan for each group using the given distribution (that dipends on the dimension of the group and the total scan of the group) –  markusian Nov 30 '11 at 16:27

1 Answer 1

If you have the counts of the number of times that each machine is scanned, I would compare the number of times each machine was scanned in a given time period with the expected Poisson distribution (a Chi-squared test would do). If the scanning is coordinated, you would expect the distribution to be more peaked than the Poisson.

share|improve this answer
    
I think that your idea is good but I'm using this approach because I'm trying to follow what I'm reading in a paper. –  markusian Nov 30 '11 at 16:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.