Using goodness of fit hypothesis testing and Benford's Law to detect online hacking

Intro

Howdy!  I'm Professor Curtis of Aspire Mountain Academy here with more statistics homework help.  Today we're going to learn how to use goodness of fit hypothesis testing and Benford's law to detect online hacking.  Here's our problem statement: The accompanying data table lists leading digits of 317 inter-arrival Internet traffic times for a computer along with the frequencies of leading digits expected with Benford's law.  The accompanying technology results are obtained when testing for goodness of fit with the distribution described by Benford's law, and H0 is rejected.  What does this result suggest about the possibility that the computer has been hacked?  Is there any corrective action that should be taken?

Solution

OK, we have a series of drop down menus for a fill in the blank statement here.  So in order to understand what the right selections are in this drop down, we need to come to a conclusion with the hypothesis test.  We look at our data here.  Notice there's no icon here to slip the data into StatCrunch so we can actually perform a hypothesis test.  That's because as was stated earlier in the problem statement, the hypothesis test has already been conducted for us.  So if we click on this link here for the technology output, we see here are the results for our hypothesis test.  Now we know in the problem statement it says H0 is rejected.  We know our null hypothesis is rejected because --- look at the P-value.  The P-value here is less than 1%.  So no matter what significance level we're using, we're going to be inside that critical region, inside the region of rejection.  And therefore we reject the null hypothesis.

We can get the same conclusion comparing the test statistic with the critical value.  Goodness-of-fit tests are by definition right-tailed tests.  So the critical region is the right tail of the distribution, the left boundary.  That right tail is going to be our critical value, which here is listed as 15.5.  Our test statistic, 20.9, is to the right of that left boundary.  So we're in the tail that is the critical region, that right tail of our distribution.  So we're in the region of rejection.  So we reject the null hypothesis.

Rejecting the null hypothesis means that the distribution that we're seeing doesn't fit the distribution we're comparing it to, which in this case is the one for Benford's Law.  So I go back to my data table.  What we're saying is that this distribution here with these frequencies does not fit the distribution here with Benford's Law because we rejected the null hypothesis.  The null hypothesis says that everything's the same, everything matches up.  So that's not what we see here because we rejected the null hypothesis.

So because the leading digits of inner arrival traffic times do not fit the distribution described by Benford's law, it appears that those times are not typical.  Benford's Law is a description of typical times.  So if we don't fit that distribution, the times we do have are therefore not typical.  And therefore there's probably some good evidence that the computer has been hacked, because if it hadn't been hacked, then we would be conforming to Benford's law.  Because we don't, then there's some evidence here that says, yeah, we were probably being hacked.  And if you're being hacked, then of course you're going to need corrective action.  I check my answer.  Good job!

And that's how we do it at Aspire Mountain Academy.  Be sure to leave your comments below and let us know how good a job we did or how we can improve.  And if your stats teacher is boring or just doesn't want to help you learn stats, go to aspiremountainacademy.com, where you can learn more about accessing our lecture videos or provide feedback on what you'd like to see.  Thanks for watching.  We'll see you in the next video.