Question

Network forensic analysis. A network forensic analyst is responsible for identifying worms, viruses, and infected nodes in the computer network. A new methodology for finding patterns in data that signify infections was investigated in IEEE Transactions on Information Forensics and Security (May, 2013). The method uses multiple filters to check strings of information. For this exercise, consider a data string of length 4 bytes (positions). Where each byte is either a 0 or a 1 (e.g., 0010). Also, consider two possible strings, named S₁ and S₂. In a simple single-filter system, the probability that and differ in any one of the bytes is .5. Derive a formula for the probability that the two strings differ on exactly x of the 4 bytes. Do you recognize this probability distribution?

Short answer

The x is approximately a binomial random variable, and the x follows a binomial distribution with n=4 and p=0.5.

Step-by-step solution

Given information

The data string of length is 4 bytes.

The number of possible two strings is S₁ and S₂.

The probability that S₁ and S₂differ in any one of the bytes is 0.5.

State the characteristics of the Binomial experiment

The characteristics of the Binomial experiment are as follows:

• The experiments consist of n trials
• Each trial consists of two outcomes only, either success or failure.
• The probability of success is represented as “p”, and the probability of failure is defined as “q”.

The trials are independent to each other.

Check whether the random variable x represents a binomial random variable or not

The data string of length is 4 bytes. So, the number of trials is n=4.

The two possible outcomes are:

• Success, S= the string that matches with the byte.
• Failure, F= the line does not match with the byte.

For each trial,

The probability of success is,

$$\begin{gathered} p=P\left(S\right) \\ =0.5 \end{gathered}$$

The probability of failure is,

$$\begin{gathered} q=1-p \\ =1-0.5 \\ =0.5 \end{gathered}$$

The probability of success is the same for all the trials.

Here, the trials are closely independent because one byte does not affect the matching of the other bytes.

The random variable x is a data string of the length of 4 bytes or trials.

Hence, the x is approximately a binomial random variable,and the x follows a binomial distribution with n=4 and p=0.5.

i.e;$x~B\left(4,0.5\right)$