Characterising Dependency in Computer Networks using Spectral Coherence

The quantification of normal and anomalous traffic flows across computer networks is a topic of pervasive interest in network se- curity, and requires the timely application of time-series methods. The transmission or reception of packets passing between computers can be represented in terms of time-stamped events and the resulting activity understood in terms of point-processes. Interestingly, in the disparate do- main of neuroscience, models for describing dependent point-processes are well developed. In particular, spectral methods which decompose second-order dependency across different frequencies allow for a rich characterisation of point-processes. In this paper, we investigate using the spectral coherence statistic to characterise computer network activ- ity, and determine if, and how, device messaging may be dependent. We demonstrate on real data, that for many devices there appears to be very little dependency between device messaging channels. However, when sig- nificant coherence is detected it appears highly structured, a result which suggests coherence may prove useful for discriminating between types of activity at the network level