As a result of society’s increasing dependence on the Internet, we observe a significant increase in Internet attacks and network management issues. However, the growing speed and volume of Internet traffic makes finding portions of traffic responsible for creating problems difficult. Current approaches to classifying connections tend to regard each connection independently of one another. However, the nature of Internet Protocol (IP) addresses points to correlations between addresses located in similar parts of the IP address space. Understanding the structural characteristics of the IP address space could lead to novel ways to create network management algorithms that deal with aggregates of flows.

We examine the structure of observed IP addresses in network traffic collected from border routers at the University of Oregon. Previous work indicates that the characteristics of observed IPv4 address structures are consistent with a multifractal model. We work to solidify the existence of this multifractal structure and provide an initial contribution toward the development of network security and management solutions that aggregate flows by IP address. We use a new method of multifractal analysis using the method of moments to produce an initial characterization of how observed IPv4 addresses relate to one another. We apply this process across traffic samples representing three different timescales, allowing us to look at the temporal dynamics of these multifractal characteristics.