I
nd
o
ne
s
ia
n J
o
urna
l o
f
E
lect
rica
l En
g
ineering
a
nd
Co
m
pu
t
er
Science
Vo
l.
23
,
No
.
2
,
A
u
g
u
s
t
20
21
,
p
p
.
1
0
6
8
~
1
0
7
2
I
SS
N:
2
5
0
2
-
4
7
5
2
,
DOI
: 1
0
.
1
1
5
9
1
/ijeecs.v
23
.i
2
.
pp
1
0
6
8
-
1
0
7
2
1068
J
o
ur
na
l ho
m
ep
a
g
e
:
h
ttp
:
//ij
ee
cs.ia
esco
r
e.
co
m
Dev
elo
pment of
a new sy
stem
t
o
d
e
tect denia
l of
serv
ice att
a
ck
using
ma
chine lea
rning
clas
sifica
tio
n
M
o
ha
m
m
a
d M
.
Ra
s
heed
1
,
Ala
a
K
.
F
a
ieq
2
,
Ahm
ed
A.
H
a
s
him
3
1,
3
Co
ll
e
g
e
o
f
E
n
g
in
e
e
rin
g
,
Un
iv
e
r
sity
o
f
In
f
o
rm
a
ti
o
n
Tec
h
n
o
lo
g
y
a
n
d
C
o
m
m
u
n
ica
ti
o
n
s,
Ba
g
h
d
a
d
,
Ir
a
q
2
Co
m
p
u
ter T
e
c
h
n
i
q
u
e
s E
n
g
i
n
e
e
rin
g
De
p
a
rtme
n
t,
Ba
g
h
d
a
d
C
o
ll
e
g
e
o
f
Eco
n
o
m
ic S
c
ien
c
e
s Un
i
v
e
rsity
,
Ba
g
h
d
a
d
,
Ira
q
Art
icle
I
nfo
AB
S
T
RAC
T
A
r
ticle
his
to
r
y:
R
ec
eiv
ed
Ma
y
5
,
2
0
2
1
R
ev
is
ed
J
u
l 3
,
2
0
2
1
Acc
ep
ted
J
u
l 1
4
,
2
0
2
1
De
n
ial
o
f
se
rv
ice
(Do
S
)
a
tt
a
c
k
is
a
m
o
n
g
th
e
m
o
st
sig
n
ifi
c
a
n
t
t
y
p
e
s
o
f
a
tt
a
c
k
s
in
c
y
b
e
r
se
c
u
rit
y
.
Th
e
o
b
jec
ti
v
e
o
f
th
is
re
se
a
rc
h
is
to
i
n
tr
o
d
u
c
e
a
n
e
w
a
lg
o
rit
h
m
to
d
ist
in
g
u
ish
n
o
rm
a
l
se
rv
ice
re
q
u
e
sts
fro
m
t
h
e
d
e
n
ial
o
f
se
rv
ice
a
tt
a
c
k
s.
Ou
r
p
ro
p
o
se
d
a
p
p
r
o
a
c
h
c
a
n
d
e
tec
t
th
e
d
e
n
ial
o
f
se
rv
ice
a
tt
a
c
k
s b
y
th
e
a
n
a
ly
sis
o
f
th
e
p
a
c
k
e
ts
se
n
t
fr
o
m
th
e
c
li
e
n
t
to
th
e
se
rv
e
r,
wh
ich
d
e
p
e
n
d
o
n
m
a
c
h
in
e
lea
rn
in
g
.
Ou
r
a
lg
o
rit
h
m
c
o
ll
e
c
ts
d
iffere
n
t
d
a
tas
e
ts
o
f
b
e
n
ig
n
n
e
two
rk
traffic
a
n
d
d
iffere
n
t
t
y
p
e
s
o
f
d
e
n
ial
o
f
se
rv
ice
a
tt
a
c
k
s,
su
c
h
a
s
DD
o
S
,
Do
S
Hu
l
k
,
D
o
S
G
o
ld
e
n
E
y
e
,
Do
S
S
l
o
wh
tt
p
tes
t,
a
n
d
Do
S
S
lo
wlo
r
is,
th
a
t
we
re
u
se
d
f
o
r
trai
n
in
g
.
M
o
r
e
o
v
e
r,
o
u
r
a
l
g
o
ri
th
m
m
o
n
it
o
rs
th
e
n
e
two
rk
e
v
e
ry
sp
e
c
ifi
c
ti
m
e
to
fin
d
d
e
n
ial
o
f
se
rv
ice
a
tt
a
c
k
.
Ou
r
re
su
lt
s
sh
o
w
th
a
t
th
e
a
lg
o
rit
h
m
c
a
n
d
e
tec
t
th
e
b
e
n
i
g
n
c
a
se
s
a
n
d
d
isti
n
g
u
ish
th
e
t
y
p
e
s
o
f
d
e
n
ial
o
f
se
rv
ice
a
tt
a
c
k
.
F
u
rth
e
rm
o
re
,
th
e
re
su
lt
s
c
o
u
l
d
a
c
h
iev
e
9
9
p
e
rc
e
n
tag
e
o
f
c
o
rre
c
t
c
las
sifica
ti
o
n
o
f
a
ll
se
lec
ted
c
a
se
s.
K
ey
w
o
r
d
s
:
Do
S a
ttack
Ma
ch
in
e
lear
n
in
g
Netwo
r
k
s
ec
u
r
ity
T
h
is i
s
a
n
o
p
e
n
a
c
c
e
ss
a
rticle
u
n
d
e
r th
e
CC B
Y
-
SA
li
c
e
n
se
.
C
o
r
r
e
s
p
o
nd
ing
A
uth
o
r
:
Mo
h
am
m
ad
M.
R
ash
ee
d
C
o
lleg
e
o
f
E
n
g
i
n
ee
r
in
g
Un
iv
er
s
ity
o
f
I
n
f
o
r
m
atio
n
T
ec
h
n
o
lo
g
y
an
d
C
o
m
m
u
n
icatio
n
s
B
ag
h
d
ad
,
I
r
aq
E
m
ail: m
o
h
am
m
a
d
.
r
ash
ee
d
@
u
o
itc.
ed
u
.
i
q
1.
I
NT
RO
D
UCT
I
O
N
Du
r
in
g
th
e
r
ec
e
n
t
y
ea
r
s
,
d
e
n
ial
o
f
s
er
v
ice
(D
o
S)
attac
k
s
h
as
b
ee
n
o
f
ten
r
e
p
o
r
ted
to
tar
g
et
a
n
in
cr
ea
s
ed
n
u
m
b
er
o
f
in
ter
n
et
s
ites
.
T
r
an
s
m
is
s
io
n
co
n
tr
o
l
p
r
o
to
co
l
(
T
C
P)
s
y
n
c
h
r
o
n
ize
(
S
YN
)
f
lo
o
d
i
n
g
is
o
n
e
o
f
th
e
m
o
s
t
d
o
m
in
an
t
t
y
p
es
o
f
th
ese
attac
k
s
[
1
]
.
B
laze
k
et
a
l.
d
escr
ib
ed
a
n
elev
atio
n
in
t
h
e
f
r
eq
u
en
cy
D
o
S
attac
k
s
d
u
r
in
g
th
is
p
e
r
io
d
,
wh
i
ch
ca
n
p
o
s
s
ib
ly
ca
u
s
e
v
ar
io
u
s
s
er
v
ices
to
b
e
d
is
r
u
p
ted
,
co
s
tin
g
s
ev
er
al
m
illi
o
n
s
to
b
illi
o
n
s
o
f
d
o
llar
s
[
2
]
.
DO
S
attac
k
s
aim
at
ce
asin
g
th
e
r
ec
ep
tio
n
o
f
m
in
im
al
-
p
e
r
f
o
r
m
a
n
ce
s
er
v
ices
b
y
t
h
e
leg
itima
te
u
s
er
s
,
th
r
o
u
g
h
th
e
c
o
n
s
u
m
p
tio
n
o
f
as
lar
g
est
am
o
u
n
t
o
f
r
eso
u
r
ce
s
as
p
o
s
s
ib
le
as
s
h
o
wn
in
Fig
u
r
e
1
.
T
C
P’s
th
r
ee
-
way
h
a
n
d
s
h
ak
e
is
a
p
r
o
ce
d
u
r
e
th
at
is
c
o
m
m
o
n
ly
u
tili
ze
d
b
y
T
C
P
SYN
f
lo
o
d
in
g
,
p
ar
ticu
lar
ly
its
lim
itatio
n
in
m
ain
tain
in
g
h
alf
-
o
p
en
co
n
n
ec
tio
n
s
.
T
h
e
c
o
m
m
o
n
ca
n
d
id
ate
tar
g
ets o
f
th
is
ty
p
e
o
f
attac
k
s
in
clu
d
e
web
,
f
ile
tr
an
s
f
er
p
r
o
t
o
co
l
(
F
T
P)
,
o
r
m
ail
s
er
v
er
s
,
alo
n
g
with
an
y
o
t
h
er
s
y
s
tem
with
a
co
n
n
ec
tio
n
to
th
e
in
ter
n
et
an
d
p
r
o
v
is
io
n
o
f
T
C
P
-
b
ased
n
etwo
r
k
s
er
v
ices.
T
h
e
b
eg
in
n
in
g
o
f
a
n
y
T
C
P
co
n
n
ec
tio
n
in
v
o
lv
es
th
e
ex
p
r
ess
io
n
o
f
th
e
clien
t
’
s
willin
g
n
ess
o
f
estab
lis
h
in
g
s
u
ch
a
co
n
n
ec
tio
n
,
wh
ich
is
in
d
icate
d
b
y
a
SYN
m
ess
ag
e
th
at
is
s
en
t
b
y
th
e
clien
t
to
t
h
e
s
er
v
e
r
.
As
a
r
e
p
ly
,
a
s
y
n
ch
r
o
n
ize
(
SYN)
an
d
ac
k
n
o
wled
g
e
(
AC
K)
SYN/A
C
K
m
ess
ag
e
is
s
en
t
b
ac
k
b
y
th
e
s
er
v
e
r
,
co
n
f
ir
m
in
g
th
e
r
ec
ei
p
t
th
e
in
i
tial
SYN
m
ess
ag
e
an
d
,
s
im
u
ltan
eo
u
s
ly
,
co
m
m
e
n
cin
g
th
e
r
eser
v
atio
n
o
f
an
e
n
tr
y
i
n
th
e
co
n
n
ec
tio
n
tab
le
an
d
b
u
f
f
er
s
p
ac
e.
Fo
llo
win
g
s
u
ch
an
ex
ch
an
g
e,
th
e
T
C
P
co
n
n
ec
tio
n
is
tr
ea
ted
as
h
alf
-
o
p
en
.
An
AC
K
m
ess
ag
e
m
u
s
t
b
e
s
en
t
b
ac
k
to
th
e
s
er
v
er
b
y
th
e
u
s
er
t
o
en
s
u
r
e
th
at
th
e
T
C
P
co
n
n
ec
tio
n
is
co
m
p
letely
estab
lis
h
ed
.
Du
r
in
g
th
e
T
C
P
SYN
f
lo
o
d
in
g
attac
k
,
en
o
r
m
o
u
s
SYN
m
ess
ag
es
with
f
ak
e
(
s
p
o
o
f
e
d
)
in
ter
n
et
p
r
o
to
co
l
(
IP
)
ad
d
r
e
s
s
es
ar
e
s
en
t
to
an
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
d
o
n
esian
J
E
lec
E
n
g
&
C
o
m
p
Sci
I
SS
N:
2502
-
4
7
5
2
Dev
elo
p
men
t o
f a
n
ew s
ystem
to
d
etec
t d
en
ia
l
o
f ser
vice
a
tta
ck
u
s
in
g
… (
Mo
h
a
mma
d
M.
R
a
s
h
ee
d
)
1069
in
d
iv
id
u
al
s
er
v
er
(
v
ictim
)
b
y
a
ce
r
tain
attac
k
er
,
am
o
n
g
a
h
ig
h
n
u
m
b
er
o
f
co
m
p
r
o
m
is
ed
u
s
er
s
s
u
b
jecte
d
to
d
is
tr
ib
u
ted
Do
S
attac
k
s
.
I
n
s
p
ite
o
f
th
e
r
ep
ly
s
en
t
b
y
th
e
s
er
v
er
to
SYN/AC
K
m
ess
a
g
es,
ab
s
o
lu
tely
n
o
ac
k
n
o
wled
g
m
en
t
o
cc
u
r
s
b
y
th
e
clien
t
to
th
ese
m
ess
ag
es.
C
o
n
s
eq
u
en
tly
,
th
e
r
eso
u
r
ce
s
o
f
th
e
s
er
v
er
ar
e
co
n
s
u
m
ed
d
u
e
to
th
e
o
cc
u
r
r
en
ce
o
f
a
lar
g
e
n
u
m
b
er
o
f
h
alf
-
o
p
en
co
n
n
ec
tio
n
s
.
T
h
is
p
r
o
ce
s
s
d
o
es
n
o
t
s
to
p
u
n
ti
l
th
e
ab
s
o
lu
te
co
n
s
u
m
p
tio
n
o
f
th
e
s
er
v
er
’
s
r
eso
u
r
ce
s
,
lea
v
in
g
n
o
m
o
r
e
ca
p
ab
ilit
y
o
f
a
cc
ep
tin
g
an
y
o
th
er
r
eq
u
ests
o
f
T
C
P
co
n
n
ec
tio
n
.
E
n
d
-
s
y
s
tem
m
eth
o
d
s
h
av
e
b
ee
n
r
ec
en
tly
s
u
g
g
e
s
ted
to
p
r
o
tect
ag
ain
s
t
SYN
f
lo
o
d
in
g
attac
k
s
.
No
n
et
h
eless
,
th
ese
m
eth
o
d
s
n
ec
ess
itate
th
at
th
e
en
d
-
s
y
s
tem
s
b
e
m
o
d
i
f
ied
.
T
h
e
y
ar
e
also
u
n
ab
le
to
p
r
o
v
i
d
e
p
r
o
tectio
n
ag
ain
s
t
th
o
s
e
attac
k
s
p
r
o
ce
ed
i
n
g
with
f
u
ll
T
C
P
h
an
d
s
h
a
k
in
g
[
3
]
.
Fu
r
th
er
m
o
r
e,
th
e
r
esear
ch
er
s
a
r
e
s
till
q
u
e
s
tio
n
in
g
th
e
p
o
ten
tial
o
v
er
h
e
ad
th
at
s
u
ch
en
d
-
s
y
s
tem
m
e
th
o
d
s
ar
e
a
b
le
to
in
tr
o
d
u
ce
.
A
co
n
tin
u
o
u
s
th
r
ea
t
to
n
etwo
r
k
s
an
d
c
o
m
p
u
ter
s
co
n
n
ec
ted
t
o
th
e
i
n
ter
n
et
is
s
till
p
o
s
ed
b
y
D
o
S
attac
k
s
.
I
n
th
e
co
m
p
u
ter
cr
im
e
an
d
s
ec
u
r
ity
s
u
r
v
e
y
r
ep
o
r
te
d
b
y
th
e
cr
im
e
s
ce
n
e
in
v
esti
g
atio
n
/f
ed
er
al
b
u
r
ea
u
o
f
in
v
esti
g
atio
n
(
C
SI/FB
I
)
,
4
2
%
o
f
th
e
p
ar
ticip
a
n
ts
r
ep
o
r
ted
Do
S
attac
k
s
as
a
m
ajo
r
is
s
u
e.
Fin
an
cial
s
etb
ac
k
s
r
esu
ltin
g
f
r
o
m
Do
S
attac
k
s
co
n
s
titu
ted
th
e
s
ec
o
n
d
lar
g
est
ca
u
s
e
o
f
lo
s
s
o
f
r
ev
e
n
u
e,
im
m
ed
iately
r
an
k
ed
a
f
ter
th
e
p
r
o
p
r
ietar
y
in
f
o
r
m
atio
n
th
ef
t [
4
]
.
W
ik
iLe
ak
s
r
ep
o
r
ted
th
at
it
wa
s
tar
g
eted
b
y
a
d
is
tr
ib
u
ted
d
e
n
ial
o
f
s
er
v
ice
(
DDo
S)
attac
k
th
at
last
ed
f
o
r
o
v
er
lo
n
g
er
th
a
n
o
n
e
wee
k
.
T
h
e
web
s
ite
s
tated
it wa
s
s
u
b
j
ec
ted
to
a
tr
af
f
ic
f
lo
o
d
o
f
1
0
g
i
g
ab
its
p
er
s
ec
o
n
d
,
ca
u
s
in
g
s
lo
wn
ess
an
d
u
n
r
esp
o
n
s
iv
en
ess
[
5
]
.
T
h
e
r
esear
ch
g
ap
i
n
th
is
p
a
p
er
is
a
p
p
ly
in
g
m
ac
h
in
e
lear
n
in
g
alg
o
r
ith
m
s
to
au
to
m
atica
lly
t
h
e
p
r
o
ce
s
s
o
f
p
r
ed
ictin
g
D
o
s
a
n
d
DDo
S
attac
k
s
s
u
ch
as
“D
Do
S”,
“Do
S
Hu
lk
”,
“Do
S
Go
ld
en
E
y
e”
,
“Do
S
Slo
wh
ttp
test
”
an
d
“Do
S
Sl
o
wlo
r
is
”.
T
h
e
r
est
o
f
th
e
p
a
p
er
is
o
r
g
an
ized
as
f
o
llo
ws
;
Sectio
n
2
d
elin
ea
tes
th
e
r
elate
d
wo
r
k
.
Sectio
n
3
d
escr
ib
es
t
h
e
s
y
s
tem
d
esig
n
.
Sectio
n
4
p
r
o
v
id
es
th
e
r
esu
lts
.
Sectio
n
5
is
co
n
clu
s
io
n
s
.
Fig
u
r
e
1
.
Ma
licio
u
s
an
d
clea
n
tr
af
f
ic
2.
RE
L
AT
E
D
WO
RK
Ma
n
y
s
tu
d
ies
h
av
e
b
ee
n
i
n
v
o
l
v
ed
in
p
r
ev
e
n
tin
g
DDo
S
attac
k
s
in
r
ec
en
t
tim
es
[
6
]
.
Su
c
h
a
p
p
r
o
ac
h
es
ar
e
d
esig
n
ed
to
aid
a
v
ictim
s
e
r
v
er
to
k
ee
p
s
er
v
in
g
r
eq
u
ests
d
u
r
in
g
th
e
o
cc
u
r
r
en
ce
o
f
attac
k
s
.
Su
ch
ap
p
r
o
ac
h
es
in
clu
d
e
th
o
s
e
r
elate
d
to
r
eso
u
r
ce
s
ca
lin
g
,
m
an
a
g
e
m
en
t,
an
d
r
elo
ca
tio
n
,
as
well
as
n
etwo
r
k
-
b
ased
m
itig
atio
n
m
eth
o
d
s
s
p
ec
if
ied
b
y
s
o
f
twar
e.
Mo
r
eo
v
e
r
,
th
er
e
is
s
ev
er
al
tech
n
iq
u
es
s
o
lv
ed
a
b
n
o
r
m
al
a
ttack
[
7
]
-
[
1
5
]
,
b
u
t
th
is
Do
s
attac
k
n
ee
d
d
if
f
er
en
t
tech
n
iq
u
e
to
s
o
lv
e
it.
So
th
at,
we
u
s
ed
d
i
f
f
er
en
t
m
o
n
itirin
g
n
etwo
r
k
attr
i
b
u
ts
to
d
is
tiq
u
is
h
b
etwe
en
n
o
r
m
al
an
d
ab
n
o
r
m
al
attac
k
,
s
u
c
h
as
s
o
u
r
ce
an
d
d
esti
n
atio
n
I
Ps
,
d
esti
n
atio
n
an
d
s
o
u
r
ce
p
o
r
ts
,
ty
p
e
o
f
attac
k
a
n
d
p
r
o
to
co
ls
,
an
d
m
o
r
e
b
e
h
av
io
r
o
f
p
a
ck
et.
As
a
m
ec
h
an
is
m
o
f
ac
tio
n
,
Do
S
attac
k
s
o
v
er
wh
elm
web
s
it
es,
clo
g
n
etwo
r
k
co
n
n
ec
tio
n
s
,
an
d
r
en
d
er
s
er
v
er
s
u
n
av
ailab
le
[
5
]
.
W
an
g
et
a
l.
[
1
6
]
p
r
o
p
o
s
ed
a
Do
S
attac
k
s
d
etec
tio
n
m
eth
o
d
th
a
t
ac
ts
o
n
th
e
v
ictim
s
id
e,
th
e
m
o
d
el
wo
r
k
ed
b
y
m
o
n
ito
r
in
g
t
h
e
n
etwo
r
k
tr
af
f
ic
p
ac
k
ets
o
n
t
h
e
p
r
i
m
a
r
y
v
ictim
s
er
v
er
.
Xiao
et
a
l.
[
1
7
]
d
etec
ted
DDo
S
attac
k
s
to
war
d
a
d
ata
ce
n
ter
b
y
em
p
lo
y
in
g
c
o
r
r
elatio
n
an
al
y
s
is
.
T
h
is
ap
p
r
o
ac
h
b
en
ef
its
f
r
o
m
th
e
c
o
r
r
elatio
n
o
f
f
lo
w
in
f
o
r
m
atio
n
with
in
th
e
d
ata
ce
n
ter
.
I
t
co
n
f
er
s
a
m
ec
h
an
is
m
th
at
d
ep
en
d
s
o
n
K
-
Nea
r
est
Neig
h
b
o
r
with
c
o
r
r
elatio
n
an
d
r
-
p
o
llin
g
m
o
d
el
f
o
r
th
e
r
e
d
u
ctio
n
o
f
th
e
o
v
er
h
ea
d
ca
u
s
ed
b
y
th
e
h
ig
h
d
e
n
s
ity
o
f
th
e
tr
ain
in
g
d
a
taset.
Kalk
an
an
d
Alag
ö
z
[
1
8
]
p
r
o
p
o
s
ed
a
m
ec
h
an
is
m
to
d
etec
t
an
d
f
ilter
DDo
S
attac
k
s
,
d
ep
en
d
i
n
g
u
p
o
n
th
e
s
co
r
e
v
alu
e
ca
lc
u
lated
f
o
r
ea
ch
in
co
m
in
g
p
ac
k
et.
T
h
e
au
th
o
r
s
s
u
g
g
ested
a
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
5
0
2
-
4
7
5
2
I
n
d
o
n
esian
J
E
lec
E
n
g
&
C
o
m
p
Sci,
Vo
l.
23
,
No
.
2
,
Au
g
u
s
t
20
21
:
1
0
6
8
-
1
0
7
2
1070
co
n
s
id
er
ab
le
in
cr
ea
s
e
in
th
e
s
u
cc
ess
o
f
s
y
s
tem
’
s
b
eh
av
io
r
to
war
d
leg
al
an
d
attac
k
p
ac
k
ets.
Dec
is
io
n
o
n
wh
eth
er
th
e
p
ac
k
et
is
leg
al
o
r
n
o
t
is
d
ec
id
ed
b
y
t
h
e
m
ec
h
an
is
m
.
T
h
e
u
tili
ze
d
in
p
u
t
attr
ib
u
tes
in
clu
d
ed
I
P
ad
d
r
ess
,
p
o
r
t
n
u
m
b
er
,
p
r
o
to
c
o
l
ty
p
e,
p
ac
k
et
s
i
ze
,
tim
e
to
liv
e
(
T
T
L
)
v
alu
e
,
an
d
T
C
P
flag
.
Ou
r
p
r
o
p
o
s
ed
tech
n
iq
u
e
is
d
if
f
er
en
t
f
r
o
m
t
h
e
ab
o
v
e
m
o
d
el
in
ter
m
s
o
f
en
v
ir
o
n
m
en
t.
Ou
r
p
r
o
p
o
s
ed
s
y
s
tem
wo
r
k
s
b
y
an
aly
zin
g
m
ess
ag
es
s
en
t
f
r
o
m
th
e
clien
t
to
th
e
s
er
v
er
with
h
is
to
r
y
p
ac
k
ets.
Af
ter
th
at,
th
e
p
r
o
p
o
s
ed
a
lg
o
r
ith
m
d
ec
id
es to
d
r
o
p
o
r
f
o
r
war
d
th
e
p
ac
k
et.
An
ap
p
r
o
ac
h
t
h
at
em
p
lo
y
s
th
e
ad
v
an
ce
d
all
r
e
p
ea
ted
p
atte
r
n
s
d
etec
tio
n
(
AR
PaD)
Alg
o
r
ith
m
was
p
r
ev
io
u
s
ly
in
tr
o
d
u
ce
d
,
allo
win
g
all
r
ep
ea
ted
p
atter
n
s
in
a
s
eq
u
en
ce
to
b
e
d
etec
ted
.
T
h
e
p
r
o
p
o
s
ed
m
et
h
o
d
allo
ws
r
ea
d
i
ly
ac
q
u
ir
in
g
th
e
r
esu
lts
r
elate
d
to
all
I
P
p
r
ef
ix
es
in
a
s
eq
u
e
n
ce
o
f
h
its
.
T
h
e
r
ef
o
r
e,
th
e
n
etwo
r
k
ad
m
in
is
tr
ato
r
r
ec
eiv
es
an
alar
m
wh
en
a
p
o
ten
tial
DDo
S
attac
k
is
b
ein
g
d
ev
elo
p
e
d
.
T
h
e
r
esu
lts
ar
e
b
ased
o
n
s
ev
er
al
ex
p
er
im
en
ts
[
1
9
]
.
A
m
eth
o
d
t
o
p
r
elim
in
a
r
y
d
et
ec
ts
DDo
S
attac
k
s
v
ia
th
e
class
if
icatio
n
o
f
n
etwo
r
k
co
n
d
i
tio
n
s
was
p
r
o
p
o
s
ed
b
y
Ng
u
y
en
a
n
d
C
h
o
i
in
2
0
1
0
[
2
0
]
,
wh
er
e
k
ey
f
ea
tu
r
es
s
er
v
ed
f
o
r
th
e
s
elec
tio
n
o
f
a
n
u
m
b
er
o
f
v
ar
iab
les.
Fu
r
th
e
r
m
o
r
e,
th
ey
u
tili
ze
d
th
e
-
n
ea
r
est
n
ei
g
h
b
o
r
(
-
NN)
ap
p
r
o
ac
h
f
o
r
th
e
class
if
icatio
n
o
f
n
etwo
r
k
co
n
d
itio
n
s
in
to
t
h
e
p
h
ases
o
f
DDo
S
attac
k
.
Mo
r
eo
v
e
r
,
T
s
ai
an
d
L
in
[
2
1
]
d
escr
ib
e
d
a
n
o
v
el
ap
p
r
o
ac
h
,
ca
lled
th
e
tr
ian
g
le
ar
ea
b
ased
n
ea
r
est
ap
p
r
o
ac
h
,
f
o
r
th
e
d
etec
tio
n
o
f
DDo
S
attac
k
s
,
wh
ic
h
r
esu
lted
in
t
h
e
im
p
r
o
v
em
e
n
t
o
f
ac
cu
r
ac
y
an
d
f
alse
p
o
s
itiv
e
r
ate
(
FP
R
)
v
alu
es.
T
h
e
co
n
ce
p
t
o
f
t
h
e
D
Do
S
attac
k
an
d
its
in
f
lu
en
ce
s
o
n
n
etwo
r
k
tr
af
f
ic
was
in
tr
o
d
u
ce
d
b
y
B
h
an
g
e
e
t
a
l.
[
2
2
]
in
2
0
1
2
.
T
h
e
au
th
o
r
s
in
v
esti
g
ated
th
i
s
attac
k
v
ia
th
e
an
aly
s
is
o
f
n
e
two
r
k
tr
af
f
ic
th
e
d
is
tr
ib
u
tio
n
,
with
th
e
aim
o
f
d
is
tin
g
u
is
h
i
n
g
ab
n
o
r
m
al
f
r
o
m
n
o
r
m
al
n
etwo
r
k
b
e
h
av
io
r
.
A
h
ig
h
ly
s
o
p
h
is
ticated
m
eth
o
d
f
o
r
th
e
d
etec
tio
n
o
f
D
o
S
attac
k
,
u
tili
zin
g
MCA,
was
in
tr
o
d
u
ce
d
b
y
T
a
n
et
a
l.
in
2
0
1
4
[
2
3
]
,
p
r
o
p
o
s
in
g
a
n
o
v
el
d
etec
tio
n
s
y
s
tem
th
at
d
ep
en
d
s
o
n
MCA
f
o
r
th
e
p
r
o
tectio
n
o
f
o
n
lin
e
s
er
v
ices
ag
ain
s
t
Do
S
attac
k
s
.
Als
o
in
2
0
1
4
,
a
m
ath
e
m
atica
l
m
o
d
el
was
d
ev
elo
p
e
d
f
o
r
th
e
esti
m
atio
n
o
f
th
e
co
m
b
i
n
ed
in
f
lu
en
ce
s
o
f
DDo
S
attac
k
p
att
er
n
an
d
n
etwo
r
k
en
v
ir
o
n
m
en
t
o
n
th
e
attac
k
.
T
h
e
m
o
d
el
was
d
esig
n
ed
b
y
in
itially
ca
p
tu
r
in
g
th
e
ad
ju
s
tm
e
n
t
b
eh
av
io
r
s
th
at
b
elo
n
g
to
th
e
v
ictim
T
C
Ps
co
n
g
esti
o
n
win
d
o
w.
3.
SYST
E
M
DE
SI
G
N
Ma
ch
in
e
lear
n
in
g
[
2
4
]
is
in
teg
r
al
p
ar
t
o
f
ar
tific
ial
in
tellig
en
ce
th
at
b
ased
o
n
im
p
r
o
v
i
n
g
r
esu
lts
th
r
o
u
g
h
lear
n
in
g
a
n
d
ex
p
e
r
ien
ce
.
J
4
8
r
ep
r
esen
ts
an
o
p
en
-
s
o
u
r
ce
J
av
a
im
p
lem
en
tatio
n
o
f
th
e
C
4
.
5
alg
o
r
ith
m
in
th
e
W
ek
a
d
ata
-
m
i
n
in
g
t
o
o
l.
C
4
.
5
is
s
o
f
twar
e
th
at
is
u
s
ed
to
p
r
o
d
u
ce
a
d
ec
is
io
n
tr
ee
d
ep
e
n
d
in
g
o
n
a
lab
ele
d
in
p
u
t d
ataset.
C
4
.
5
is
co
m
m
o
n
ly
d
escr
ib
ed
as a
s
tat
is
tical
cla
s
s
if
ier
,
g
iv
en
th
e
p
o
s
s
ib
ilit
y
o
f
u
s
in
g
t
h
e
d
ec
is
io
n
tr
ee
s
it
g
en
er
ates
f
o
r
th
e
p
u
r
p
o
s
e
o
f
class
if
icatio
n
[
2
5
]
.
Ou
r
p
r
o
p
o
s
ed
m
eth
o
d
a
d
o
p
ts
th
e
m
ac
h
in
e
lear
n
in
g
class
if
ies
alg
o
r
ith
m
o
f
ty
p
e
J
4
8
.
T
h
e
s
elec
ted
tr
ain
in
g
s
am
p
l
es
in
clu
d
e
th
e
b
e
n
ig
n
a
n
d
DD
o
S,
Do
S
Hu
lk
,
Do
S
Go
ld
en
E
y
e,
Do
S
Slo
wh
ttp
test
an
d
Do
S
Slo
wlo
r
is
s
am
p
les,
ca
p
tu
r
ed
b
y
Sh
ar
af
ald
i
n
et
a
l.
[
2
6
]
.
T
h
e
p
r
o
p
o
s
e
d
m
eth
o
d
c
o
n
tain
s
b
e
n
ig
n
a
n
d
Do
S
attac
k
s
as
n
etwo
r
k
tr
af
f
ic
s
am
p
les.
W
e
test
ed
th
e
n
e
two
r
k
in
d
if
f
er
e
n
t
b
eh
av
io
r
al
o
f
attac
k
.
So
t
h
at,
we
k
n
o
w
ev
er
y
lab
el,
wh
en
th
e
n
etwo
r
k
was
r
ea
d
y
,
we
c
ap
tu
r
ed
it
b
y
u
s
in
g
C
I
C
Flo
wM
e
ter
.
T
h
e
d
ataset
lab
eled
f
o
r
e
v
er
y
ca
p
tu
r
ed
,
we
ca
p
tu
r
ed
f
i
v
e
o
f
d
i
f
f
er
en
t
th
e
Do
S
attac
k
d
ataset
an
d
o
n
e
o
f
b
en
ig
n
d
ataset;
we
u
s
ed
th
is
d
ata
s
et
f
o
r
tr
ain
in
g
.
Mo
r
e
o
v
er
,
e
v
er
y
s
am
p
le
in
clu
d
es
m
an
y
attr
ib
u
tes,
s
u
ch
as
s
o
u
r
ce
an
d
d
esti
n
atio
n
I
Ps
,
d
esti
n
atio
n
an
d
s
o
u
r
ce
p
o
r
ts
,
ty
p
e
o
f
attac
k
an
d
p
r
o
t
o
co
ls
,
an
d
m
o
r
e
b
e
h
av
io
r
o
f
p
ac
k
et.
T
h
e
n
u
m
b
e
r
o
f
attr
ib
u
tes
f
o
r
ev
er
y
s
am
p
le
is
s
av
ed
as
a
C
SV
f
ile,
is
7
9
.
W
e
u
s
ed
1
4
4
0
0
s
am
p
les
f
o
r
tr
ain
in
g
an
d
test
in
g
,
9
6
0
0
s
am
p
les
f
o
r
tr
ain
in
g
an
d
4
8
0
0
s
am
p
les
f
o
r
test
in
g
.
T
h
e
tr
ain
in
g
d
ataset
we
ca
lled
it
i
n
th
e
f
lo
wch
ar
t
d
iag
r
am
as
s
h
o
wn
i
n
Fig
u
r
e
1
is
“f
ir
s
t
d
ataset”.
T
h
e
test
in
g
d
ataset
we
ca
lled
it
in
th
e
f
lo
wch
a
r
t
d
iag
r
am
as
s
h
o
wn
i
n
Fig
u
r
e
1
is
“
s
ec
o
n
d
d
ataset”.
I
n
th
e
tr
ain
in
g
p
ar
t,
we
d
iv
i
d
ed
9
6
0
0
f
o
r
ea
c
h
o
f
th
e
b
e
n
ig
n
a
n
d
DDo
S,
D
o
S
Hu
lk
,
Do
S
G
o
ld
en
E
y
e,
Do
S
Slo
wh
ttp
test
,
an
d
Do
S
Slo
wlo
r
is
,
s
o
each
in
clu
d
e
d
1
6
0
0
s
am
p
le
s
.
I
n
th
e
test
in
g
p
ar
t,
we
d
iv
id
ed
4
8
0
0
f
o
r
ea
c
h
o
f
th
e
b
en
ig
n
an
d
DDo
S,
Do
S
Hu
lk
,
Do
S
Go
ld
en
E
y
e,
Do
S
Slo
wh
ttp
test
,
a
n
d
Do
S
S
lo
wlo
r
is
,
s
o
each
in
clu
d
ed
8
0
0
s
am
p
les.
T
h
e
alg
o
r
ith
m
m
o
n
ito
r
s
th
e
n
etwo
r
k
to
r
ea
d
7
8
attr
ib
u
tes
with
o
u
t
lab
el
attr
ib
u
te
b
ec
au
s
e
it
u
s
ed
f
o
r
test
in
g
.
W
h
en
th
e
n
u
m
b
er
o
f
s
am
p
les
is
m
o
n
ito
r
ed
b
y
th
e
alg
o
r
ith
m
an
d
s
h
o
u
ld
r
ea
ch
es
to
8
0
0
s
am
p
les,
th
e
al
g
o
r
ith
m
s
av
es
th
em
as
a
s
ec
o
n
d
d
ataset
with
o
u
t
lab
el.
T
h
e
alg
o
r
ith
m
ch
an
g
es
an
d
test
s
th
e
lab
el.
T
h
e
al
g
o
r
ith
m
ch
an
g
ed
th
e
s
eq
u
en
ce
o
f
th
e
lab
el
(
So
L
)
th
at
s
tar
ts
f
r
o
m
“b
e
n
ig
n
”,
“
DDo
S”,
“Do
S
Hu
lk
”,
“Do
S
Go
ld
en
E
y
e”
,
“Do
S
Slo
wh
ttp
test
”
an
d
en
d
s
with
“Do
S
Slo
wlo
r
is
”.
Af
ter
th
at,
th
e
alg
o
r
ith
m
f
in
d
s
th
e
b
est
r
esu
lt
lab
el
(
B
R
L
)
,
d
ep
en
d
i
n
g
o
n
th
e
lab
el
t
h
at
w
as
ch
an
g
e
d
as
s
h
o
wn
in
Fig
u
r
e
2
.
I
f
th
e
h
ig
h
ac
c
u
r
ac
y
is
la
b
eled
as
b
en
ig
n
,
t
h
e
alg
o
r
ith
m
co
n
tin
u
es
to
ca
p
tu
r
e
a
n
ew
d
ataset;
o
th
er
wis
e,
it
s
en
d
s
a
war
n
in
g
o
f
an
attac
k
,
with
th
e
ty
p
e
o
f
t
h
at
attac
k
.
Ap
p
r
o
ac
h
es
th
at
in
clu
d
e
s
tatis
t
ical
an
aly
s
i
s
,
m
ac
h
in
e
lear
n
in
g
,
an
d
d
ata
m
in
in
g
ca
n
b
e
u
s
ed
in
th
e
d
etec
tio
n
o
f
DDo
S a
ttack
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
d
o
n
esian
J
E
lec
E
n
g
&
C
o
m
p
Sci
I
SS
N:
2502
-
4
7
5
2
Dev
elo
p
men
t o
f a
n
ew s
ystem
to
d
etec
t d
en
ia
l
o
f ser
vice
a
tta
ck
u
s
in
g
… (
Mo
h
a
mma
d
M.
R
a
s
h
ee
d
)
1071
Fig
u
r
e
2
.
Flo
wch
ar
t
d
iag
r
am
o
f
p
r
o
p
o
s
ed
s
y
s
tem
4.
RE
SU
L
T
S
W
e
test
ed
o
u
r
alg
o
r
ith
m
b
as
ed
o
n
t
h
e
s
am
p
les
th
at
wer
e
co
llected
with
s
ix
d
atasets
as
s
h
o
wn
in
T
ab
le
1
.
T
h
e
f
ir
s
t
test
ed
r
esu
lt
was
th
at
o
f
th
e
b
en
i
g
n
s
am
p
l
es;
th
e
r
esu
lt
s
tated
th
at
7
8
2
s
am
p
les
ar
e
b
en
ig
n
.
Mo
r
eo
v
er
,
th
e
alg
o
r
ith
m
class
if
ied
3
s
am
p
les
as
DDo
S,
2
as
Do
s
Hu
lk
,
2
as
Do
S
Go
ld
en
E
y
e,
1
0
as
Do
S
Slo
wh
ttp
test
,
an
d
1
as Do
S Slo
wlo
r
is
; w
h
er
e
th
e
class
if
icatio
n
ac
cu
r
ac
y
o
f
b
en
i
g
n
was 9
7
.
7
p
er
ce
n
ta
g
e.
T
h
e
s
ec
o
n
d
test
ed
r
esu
lt
was
t
h
at
o
f
th
e
DDo
S
s
am
p
les,
wh
er
e
7
9
8
s
am
p
les
wer
e
class
if
y
as
DDo
S.
Ho
wev
er
,
th
e
alg
o
r
ith
m
als
o
s
h
o
wed
an
in
co
r
r
ec
t
class
if
i
ca
tio
n
,
wh
er
e
it
class
if
ied
2
s
am
p
les
as
b
en
ig
n
,
wh
er
e
th
e
class
if
icatio
n
ac
cu
r
ac
y
o
f
DDo
S
was
9
9
.
8
p
er
ce
n
tag
e.
T
h
e
th
ir
d
test
ed
r
esu
lt
was
th
at
o
f
th
e
Do
S
Hu
lk
s
am
p
les.
T
h
e
alg
o
r
ith
m
class
if
ied
7
9
9
s
am
p
les
as
Do
S
Hu
lk
.
Ho
wev
e
r
,
1
s
am
p
le
was
class
if
ied
as
b
en
ig
n
;
th
e
class
if
icatio
n
ac
cu
r
ac
y
f
o
r
Do
S
Hu
lk
was
9
9
.
9
p
er
ce
n
tag
e.
T
h
e
f
o
u
r
th
test
ed
was
Do
S
Go
ld
en
E
y
e,
it wa
s
8
0
0
s
am
p
le
s
; th
e
class
if
icatio
n
ac
cu
r
ac
y
was 1
0
0
p
er
ce
n
tag
e.
T
h
e
f
if
th
test
ed
was
Do
S
Sl
o
wh
ttp
test
,
it
was
7
9
4
o
f
8
0
0
s
am
p
les
wer
e
c
o
r
r
ec
tly
cla
s
s
if
ied
;
th
e
ac
cu
r
ac
y
was
9
9
.
3
p
er
ce
n
tag
e.
Ho
wev
er
,
6
s
am
p
les
wer
e
in
co
r
r
ec
tly
class
if
ied
,
am
o
n
g
wh
ich
4
as
Do
S
Slo
wlo
r
is
an
d
1
s
am
p
le
as
ea
ch
o
f
Do
S
Go
ld
en
E
y
e
a
n
d
b
en
ig
n
.
Fin
ally
,
th
e
s
ix
t
h
test
ed
was
Do
S
Slo
wh
ttp
test
,
it
w
as
7
9
4
o
f
8
0
0
s
am
p
les
wer
e
c
o
r
r
ec
tl
y
class
if
ied
;
th
e
ac
cu
r
ac
y
w
as
9
9
.
3
p
er
ce
n
tag
e.
Ho
wev
er
,
6
s
am
p
les we
r
e
in
c
o
r
r
ec
tly
class
if
ied
,
am
o
n
g
wh
i
ch
4
as Do
S Slo
wh
ttp
test
an
d
2
as
b
en
ig
n
.
T
ab
le
1
.
R
esu
lt o
f
p
r
o
p
o
s
ed
s
y
s
tem
Ty
p
e
o
f
S
a
mp
l
e
N
u
mb
e
r
o
f
S
a
mp
l
e
s
B
e
n
i
gn
D
D
o
S
D
o
S
H
u
l
k
D
o
S
G
o
l
d
e
n
E
y
e
D
o
S
S
l
o
w
h
t
t
p
t
e
s
t
D
o
S
S
l
o
w
l
o
r
i
s
C
o
r
r
e
c
t
C
l
a
s
si
f
i
c
a
t
i
o
n
B
e
n
i
g
n
800
782
3
2
2
10
1
9
7
.
8
%
D
D
o
S
800
2
798
0
0
0
0
9
9
.
8
%
D
o
S
H
u
l
k
800
1
0
799
0
0
0
9
9
.
9
%
D
o
S
G
o
l
d
e
n
E
y
e
800
0
0
0
800
0
0
100%
D
o
S
S
l
o
w
h
t
t
p
t
e
s
t
800
1
0
0
1
794
4
9
9
.
3
%
D
o
S
S
l
o
w
l
o
r
i
s
800
2
0
0
0
4
794
9
9
.
3
%
T
o
t
a
l
o
f
C
o
r
r
e
c
t
C
l
a
s
si
f
i
c
a
t
i
o
n
9
9
.
3
%
5.
CO
NCLU
SI
O
NS
Ou
r
p
r
o
p
o
s
ed
m
ac
h
in
e
lear
n
i
n
g
class
if
ier
alg
o
r
ith
m
is
o
f
th
e
ty
p
e
J
4
8
.
W
e
s
elec
ted
b
en
ig
n
an
d
DDo
S,
Do
S
Hu
lk
,
Do
S
Go
ld
en
E
y
e,
Do
S
Slo
wh
ttp
test
an
d
Do
S
Slo
wlo
r
is
s
am
p
les
f
o
r
t
ested
o
u
r
p
r
o
p
o
s
ed
s
y
s
tem
.
T
h
ey
wer
e
ca
p
tu
r
ed
b
y
u
s
in
g
C
I
C
Flo
wM
eter
,
f
iv
e
l
ab
eled
a
s
h
a
v
in
g
o
n
e
ty
p
e
o
f
th
e
f
iv
e
Do
S
lab
els,
wh
ile
o
n
e
h
a
d
th
e
lab
el
o
f
b
e
n
ig
n
.
Mo
r
eo
v
e
r
,
ev
er
y
s
am
p
l
e
in
clu
d
ed
m
an
y
attr
i
b
u
tes,
in
clu
d
in
g
th
e
s
o
u
r
ce
an
d
d
esti
n
atio
n
I
Ps
,
d
esti
n
atio
n
an
d
s
o
u
r
ce
p
o
r
ts
,
ty
p
e
o
f
attac
k
an
d
p
r
o
t
o
co
ls
,
an
d
m
o
r
e
b
eh
av
io
r
o
f
p
ac
k
et
.
T
h
e
f
o
r
m
ed
co
llectiv
ely
7
9
a
ttrib
u
tes
f
o
r
ev
er
y
s
am
p
le,
w
h
ich
wer
e
s
av
ed
as
a
C
SV
f
ile.
W
e
test
ed
o
u
r
alg
o
r
ith
m
b
ased
o
n
th
e
s
am
p
les
co
llected
with
s
ix
d
atase
ts
.
Ou
r
r
esu
lts
o
r
all
th
e
s
elec
te
d
ca
s
es
s
h
o
wed
th
e
ac
cu
r
ac
y
o
f
p
r
o
p
o
s
ed
s
y
s
tem
was
9
9
p
er
ce
n
tag
e
o
f
co
r
r
ec
t
class
if
icatio
n
.
I
n
th
e
f
u
tu
r
e
w
o
r
k
,
we
will
test
o
u
r
alg
o
r
ith
m
in
v
ar
io
u
s
m
o
b
ile
at
tack
s
s
u
ch
as
s
ca
r
ewa
r
e
an
d
S
MS.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
5
0
2
-
4
7
5
2
I
n
d
o
n
esian
J
E
lec
E
n
g
&
C
o
m
p
Sci,
Vo
l.
23
,
No
.
2
,
Au
g
u
s
t
20
21
:
1
0
6
8
-
1
0
7
2
1072
RE
F
E
R
E
NC
E
S
[1
]
V.
A.
S
iri
s
a
n
d
F
.
P
a
p
a
g
a
l
o
u
“
Ap
p
li
c
a
ti
o
n
o
f
a
n
o
m
a
ly
d
e
tec
ti
o
n
a
l
g
o
rit
h
m
s
fo
r
d
e
tec
ti
n
g
S
YN
fl
o
o
d
in
g
a
t
tac
k
s,”
i
n
IE
EE
Glo
b
a
l
T
e
lec
o
mm
u
n
ica
ti
o
n
s
Co
n
fer
e
n
c
e
GLO
BE
COM
'04
,
2
0
0
4
,
p
p
.
2
0
5
0
–
2
0
5
4
,
d
o
i:
1
0
.
1
1
0
9
/G
LOCOM.
2
0
0
4
.
1
3
7
8
3
7
2
[2
]
R.
B.
Blaz
e
k
,
H.
Kim
,
B.
R
o
z
o
v
sk
ii
,
A.
Tarta
k
o
v
sk
y
,
“
A
n
o
v
e
l
a
p
p
r
o
a
c
h
to
d
e
tec
ti
o
n
o
f
d
e
n
ial
-
of
-
se
rv
ice
a
tt
a
c
k
s
v
ia
a
d
a
p
ti
v
e
se
q
u
e
n
ti
a
l
a
n
d
b
a
tch
s
e
q
u
e
n
ti
a
l
c
h
a
n
g
e
-
p
o
i
n
t
d
e
tec
ti
o
n
m
e
th
o
d
s,”
i
n
:
Pro
c
e
e
d
i
n
g
s
o
f
I
EE
E
W
o
rk
sh
o
p
o
n
S
y
ste
ms
,
M
a
n
,
a
n
d
Cy
b
e
rn
e
ti
c
s In
fo
rm
a
ti
o
n
Assu
r
a
n
c
e
,
Ju
n
e
2
0
0
1
.
[3
]
G
.
R.
Zarg
a
r
a
n
d
T.
Ba
g
h
a
ie,
“
Ca
teg
o
ry
Ba
se
d
In
tr
u
sio
n
De
tec
ti
o
n
Us
in
g
P
CA,”
In
ter
n
a
ti
o
n
a
l
J
o
u
rn
a
l
o
f
In
fo
rm
a
t
io
n
S
e
c
u
rity
,
v
o
l.
3
,
n
o
.
4
,
p
p
.
2
5
9
-
2
7
1
,
2
0
1
2
,
d
o
i:
1
0
.
4
2
3
6
/j
is.2
0
1
2
.
3
4
0
3
3
.
[4
]
W.
W.
S
treilei
n
,
D.
J.
F
ried
,
a
n
d
R
.
K.
Cu
n
n
i
n
g
g
h
a
m
,
“
De
tec
ti
n
g
flo
o
d
-
b
a
se
d
d
e
n
ial
-
of
-
se
rv
ice
a
tt
a
c
k
s
wit
h
S
NMP
/RM
ON
,
”
in
Pro
c
e
e
d
in
g
s
o
f
th
e
W
o
rk
sh
o
p
o
n
S
t
a
ti
stic
a
l
a
n
d
M
a
c
h
i
n
e
.
L
e
a
r
n
in
g
T
e
c
h
n
iq
u
e
s
in
Co
mp
u
ter
In
tru
sio
n
De
tec
ti
o
n
,
Ge
o
rg
e
M
a
s
o
n
U
n
ive
rs
it
y
,
S
e
p
tem
b
e
r
2
0
0
3
.
[5
]
R.
Th
a
n
d
e
e
sw
a
ra
n
a
n
d
M
.
A.
S
.
Du
ra
i,
“
Bi
-
lev
e
l
u
se
r
a
u
t
h
e
n
ti
c
a
ti
o
n
f
o
r
e
n
rich
i
n
g
le
g
it
ima
tes
a
n
d
e
ra
d
ica
ti
n
g
d
u
p
li
c
a
tes
in
c
lo
u
d
i
n
fra
stru
c
tu
re
,
”
In
ter
n
a
ti
o
n
a
l
J
o
u
rn
a
l
o
f
C
o
mp
u
ter
Ai
d
e
d
E
n
g
in
e
e
rin
g
a
n
d
T
e
c
h
n
o
lo
g
y
,
v
o
l
.
1
2
,
n
o
.
1
,
p
p
.
9
5
-
1
1
2
,
2
0
2
0
,
d
o
i:
1
0
.
1
5
0
4
/i
jca
e
t.
2
0
2
0
.
1
0
3
8
3
6
.
[6
]
M
.
Ars
h
i,
M
.
Na
sre
e
n
,
a
n
d
K.
M
a
d
h
a
v
i,
“
A
S
u
r
v
e
y
o
f
DD
OS
Att
a
c
k
s
Us
in
g
M
a
c
h
in
e
Lea
rn
in
g
Te
c
h
n
iq
u
e
s,”
E3
S
W
e
b
Co
n
f.
,
2
0
2
0
,
d
o
i
:
1
0
.
1
0
5
1
/e3
sc
o
n
f/2
0
2
0
1
8
4
0
1
0
5
2
.
[7
]
M
.
M
.
Ra
sh
e
e
d
,
N.
M
.
No
rwa
wi,
O.
G
h
a
z
a
li
,
a
n
d
M
.
K.
F
a
a
e
q
,
“
De
tec
ti
o
n
a
lg
o
ri
th
m
fo
r
i
n
tern
e
t
wo
rm
s
sc
a
n
n
in
g
th
a
t
u
se
d
u
se
r
d
a
tag
ra
m
p
ro
t
o
c
o
l,
”
IJ
ICS
,
v
o
l.
1
1
,
n
o
.
1
,
2
0
1
9
,
d
o
i:
/1
0
.
1
5
0
4
/IJICS
.
2
0
1
9
.
0
9
6
8
4
7
.
[8
]
M
.
M
.
Ra
sh
e
e
d
a
n
d
M
.
K.
F
a
a
e
q
,
“
Be
h
a
v
io
ra
l
De
tec
ti
o
n
o
f
S
c
a
n
n
i
n
g
W
o
rm
in
Cy
b
e
r
De
fe
n
se
,
”
in
Pro
c
e
e
d
in
g
s
o
f
th
e
Fu
t
u
re
T
e
c
h
n
o
l
o
g
ies
Co
n
fe
re
n
c
e
(FT
C)
2
0
1
8
,
S
p
rin
g
e
r
In
ter
n
a
ti
o
n
a
l
P
u
b
li
s
h
in
g
,
2
0
1
8
,
p
p
.
2
1
4
–
2
2
5
,
d
o
i:
1
0
.
1
0
0
7
/9
7
8
-
3
-
0
3
0
-
0
2
6
8
3
-
7
_
1
6
.
[9
]
N.
S
.
Ra
o
,
K.
C.
S
e
k
h
a
ra
iah
,
a
n
d
A.
A.
Ra
o
,
“
A
su
r
v
e
y
o
f
d
istr
ib
u
t
e
d
d
e
n
ial
-
of
-
se
rv
ice
(DD
o
S
)
d
e
fe
n
c
e
tec
h
n
iq
u
e
s
in
IS
P
d
o
m
a
in
s,”
in
In
n
o
v
a
ti
o
n
s i
n
Co
m
p
u
t
e
r S
c
ie
n
c
e
a
n
d
E
n
g
i
n
e
e
rin
g
,
v
o
l.
3
2
,
p
p
.
2
2
1
–
2
3
0
,
2
0
1
9
.
[1
0
]
Z.
K.
M
a
se
e
r,
R.
Yu
s
o
f,
N.
Ba
h
a
m
a
n
,
S
.
A
.
M
o
sta
fa
,
a
n
d
C.
F
.
M
.
F
o
o
z
y
,
“
Be
n
c
h
m
a
rk
in
g
o
f
m
a
c
h
i
n
e
lea
rn
in
g
f
o
r
a
n
o
m
a
ly
b
a
se
d
in
tr
u
sio
n
d
e
tec
ti
o
n
sy
ste
m
s
in
t
h
e
CICIDS2
0
1
7
d
a
tas
e
t,
”
IEE
E
Acc
e
ss
,
v
o
l.
9
,
p
p
.
2
2
3
5
1
–
2
2
3
7
0
,
2
0
2
1
,
d
o
i:
1
0
.
1
1
0
9
/ACCE
S
S
.
2
0
2
1
.
3
0
5
6
6
1
4
.
[1
1
]
B.
A.
Kh
a
laf,
S
.
A.
M
o
sta
fa
,
A.
M
u
sta
p
h
a
,
M
.
A.
M
o
h
a
m
m
e
d
,
a
n
d
W.
M
.
A
b
d
u
a
ll
a
h
,
“
Co
m
p
re
h
e
n
siv
e
re
v
iew
o
f
a
rti
ficia
l
in
telli
g
e
n
c
e
a
n
d
sta
ti
stic
a
l
a
p
p
ro
a
c
h
e
s
in
d
istri
b
u
te
d
d
e
n
i
a
l
o
f
se
rv
ice
a
tt
a
c
k
a
n
d
d
e
fe
n
se
m
e
th
o
d
s
,
”
I
EE
E
Acc
e
ss
,
v
o
l.
7
,
p
p
.
5
1
6
9
1
–
5
1
7
1
3
,
2
0
1
9
,
d
o
i:
1
0
.
1
1
0
9
/ACCE
S
S
.
2
0
1
9
.
2
9
0
8
9
9
8
.
[1
2
]
M
.
M
.
Ra
sh
e
e
d
,
S
.
Ba
d
ra
wi,
M
.
K.
F
a
a
e
q
,
a
n
d
A.
K.
F
a
ieq
,
“
De
tec
ti
n
g
a
n
d
o
p
ti
m
izin
g
i
n
tern
e
t
wo
rm
traffic
sig
n
a
tu
re
,
”
2
0
1
7
8
t
h
In
t
.
C
o
n
f
.
o
n
In
f
.
T
e
c
.
(ICIT
),
M
a
y
2
0
1
7
,
d
o
i:
1
0
.
1
1
0
9
/ICI
TE
CH.2
0
1
7
.
8
0
7
9
9
6
1
.
[1
3
]
A.
Zu
l
h
il
m
i,
S
.
A.
M
o
sta
fa
,
B.
A.
Kh
a
laf,
A.
M
u
sta
p
h
a
,
a
n
d
S
.
S
.
Ten
a
h
,
“
A
c
o
m
p
a
riso
n
o
f
th
re
e
m
a
c
h
in
e
lea
r
n
in
g
a
lg
o
rit
h
m
s
in
th
e
c
las
sifica
ti
o
n
o
f
n
e
two
r
k
in
tru
si
o
n
,
”
in
Pro
c
e
e
d
in
g
s
o
f
th
e
I
n
ter
n
a
ti
o
n
a
l
Co
n
fer
e
n
c
e
o
n
A
d
v
a
n
c
e
s
in
Cy
b
e
r S
e
c
u
rity
,
P
e
n
a
n
g
,
M
a
lay
sia
,
Ju
ly
2
0
2
0
,
p
p
.
3
1
3
–
3
2
4
.
[1
4
]
M
.
Rin
g
,
S
.
W
u
n
d
e
rli
c
h
,
D.
G
rü
d
l,
D.
La
n
d
e
s,
a
n
d
A.
Ho
th
o
,
“
F
lo
w
-
b
a
se
d
b
e
n
c
h
m
a
rk
d
a
ta
se
ts
fo
r
in
tr
u
sio
n
d
e
tec
ti
o
n
,
”
Pr
o
c
.
o
f
t
h
e
1
6
th
Eu
ro
p
e
a
n
C
o
n
f
.
o
n
Cy
b
e
r W
a
rf
a
re
a
n
d
S
e
c
u
rity
,
D
u
b
l
in
,
Ire
lan
d
,
2
0
1
7
,
p
p
.
3
6
1
-
3
6
9
.
[1
5
]
M
.
M
.
Ra
sh
e
e
d
,
A.
K.
F
a
ieq
,
a
n
d
A.
A.
Ha
sh
im,
“
An
d
ro
id
Bo
tn
e
t
De
tec
ti
o
n
Us
in
g
M
a
c
h
in
e
Lea
rn
in
g
,
”
I
n
g
é
n
ier
ie
d
e
s S
y
stè
me
s D In
fo
rm
a
ti
o
n
,
v
o
l.
2
5
,
n
o
.
1
,
p
p
.
1
2
7
–
1
3
0
,
F
e
b
.
2
0
2
0
,
d
o
i:
1
0
.
1
8
2
8
0
/i
si.
2
5
0
1
1
7
.
[1
6
]
J.
Wan
g
,
R
.
C.
-
W
.
P
h
a
n
,
J.
N.
W
h
it
ley
,
a
n
d
D.
J.
P
a
rish
,
“
Au
g
m
e
n
ted
Attac
k
Tree
M
o
d
e
li
n
g
o
f
Dist
rib
u
te
d
De
n
ial
o
f
S
e
rv
ice
s
a
n
d
Tree
Ba
se
d
Attac
k
De
tec
ti
o
n
M
e
th
o
d
,
”
pr
e
se
n
ted
a
t
th
e
2
0
1
0
IEE
E
1
0
th
I
n
ter
n
a
ti
o
n
a
l
Co
n
fer
e
n
c
e
o
n
C
o
mp
u
ter
a
n
d
I
n
fo
rm
a
ti
o
n
T
e
c
h
n
o
l
o
g
y
(CI
T
)
,
Ju
n
.
2
0
1
0
,
h
tt
p
s:/
/d
o
i
.
o
r
g
/1
0
.
1
1
0
9
/CIT
.
2
0
1
0
.
1
8
5
.
[1
7
]
P
.
Xia
o
,
W
.
Qu
,
H.
Qi
a
n
d
Z.
Li
,
“
De
tec
ti
n
g
DD
o
S
a
tt
a
c
k
s
a
g
a
in
st
d
a
ta
c
e
n
ter
with
c
o
rre
latio
n
a
n
a
l
y
sis,”
C
o
m
p
u
t
.
Co
mm
u
n
.,
v
o
l.
6
7
,
p
p
.
6
6
–
74
,
2
0
1
5
,
d
o
i:
1
0
.
1
0
1
6
/j
.
c
o
m
c
o
m
.
2
0
1
5
.
0
6
.
0
1
2
.
[1
8
]
K.
Ka
lk
a
n
a
n
d
F
.
Ala
g
ö
z
,
“
A
d
istri
b
u
ted
fi
l
terin
g
m
e
c
h
a
n
ism
a
g
a
in
st
DD
o
S
a
tt
a
c
k
s:
S
c
o
re
F
o
r
Co
re
,
”
Co
mp
u
t
.
Ne
tw.
,
v
o
l.
1
0
8
,
p
p
.
1
9
9
–
2
0
9
,
2
0
1
6
,
d
o
i:
1
0
.
1
0
1
6
/j
.
c
o
m
n
e
t.
2
0
1
6
.
0
8
.
0
2
3
.
[1
9
]
K.
Xy
lo
g
ian
n
o
p
o
u
l
o
s,
P
.
Ka
ra
m
p
e
las
,
a
n
d
R.
Alh
a
jj
,
“
Early
DD
o
S
De
tec
ti
o
n
Ba
se
d
o
n
Da
ta
M
in
in
g
Tec
h
n
i
q
u
e
s,”
IFI
P
In
t
.
l
W
o
rk
sh
o
p
o
n
I
n
f
.
S
e
c
u
r
it
y
T
h
e
o
ry
a
n
d
Pra
c
ti
c
e
,
2
0
1
4
,
p
p
.
1
9
0
–
1
9
9
,
d
o
i:
1
0
.
1
0
0
7
/
9
7
8
-
3
-
6
6
2
-
4
3
8
2
6
-
8
_
1
5
.
[2
0
]
H.
V.
N
g
u
y
e
n
a
n
d
Y.
Ch
o
i,
“
P
ro
a
c
ti
v
e
d
e
tec
ti
o
n
o
f
DD
o
S
a
tt
a
c
k
su
ti
li
z
in
g
k
-
NN
c
las
sifier
in
a
n
a
n
ti
-
DD
o
S
fra
m
e
wo
rk
,”
In
t
.
J
o
u
rn
a
l
o
f
El
e
c
t
ric
a
l,
Co
m
p
u
ter
,
a
n
d
S
y
ste
ms
En
g
in
e
e
rin
g
,
v
o
l.
4
,
n
o
.
4
,
p
p
.
2
4
7
–
2
5
2
,
2
0
1
0
.
[2
1
]
C.
F
.
Tsa
i
a
n
d
C.
Y.
Li
n
,
“
A
t
rian
g
le
a
re
a
b
a
se
d
n
e
a
re
st
n
e
ig
h
b
o
rs
a
p
p
ro
a
c
h
t
o
i
n
tru
si
o
n
d
e
tec
ti
o
n
,
”
P
a
tt
e
r
n
Re
c
o
g
n
it
i
o
n
,
v
o
l.
4
3
,
n
o
.
1
,
p
p
.
2
2
2
–
2
2
9
,
2
0
1
0
,
d
o
i:
1
0
.
1
0
1
6
/j
.
p
a
tco
g
.
2
0
0
9
.
0
5
.
0
1
7
.
[2
2
]
A.
Bh
a
n
g
e
,
A.
S
y
a
d
,
a
n
d
S
.
S
i
n
g
h
Th
a
k
u
r,
“
DD
o
S
a
tt
a
c
k
s
imp
a
c
t
o
n
n
e
two
rk
traffic
a
n
d
it
s
d
e
tec
t
io
n
a
p
p
ro
a
c
h
,
”
In
ter
n
a
t
io
n
a
l
J
o
u
rn
a
l
o
f
C
o
mp
u
ter
Ap
p
l
ica
ti
o
n
s
,
v
o
l.
40,
n
o
.
1
1
,
p
p
.
36
–
4
0
,
2
0
1
2
d
o
i
:
1
0
.
5
1
2
0
/
5
0
1
1
-
7
3
3
2
.
[2
3
]
Z.
Y.
Ta
n
,
A.
Ja
m
d
a
g
n
i,
X.
J.
He
,
P
.
Na
n
d
a
,
a
n
d
R.
P
.
Li
u
,
“
A
sy
s
tem
fo
r
d
e
n
ial
-
of
-
se
rv
ice
a
tt
a
c
k
d
e
tec
ti
o
n
b
a
se
d
o
n
m
u
lt
iv
a
ri
a
te
c
o
rre
lati
o
n
a
n
a
l
y
sis,”
IEE
E
T
ra
n
sa
c
ti
o
n
s
o
n
P
a
ra
ll
e
la
n
d
Distrib
u
ted
S
y
ste
ms
,
v
o
l.
25,
n
o
.
2,
p
p
.
4
4
7
–
4
5
6
,
2
0
1
4
,
d
o
i:
1
0
.
1
1
0
9
/
TP
DS.
2
0
1
3
.
1
4
6
.
[2
4
]
C.
G
ro
sa
n
a
n
d
A.
Ab
ra
h
a
m
,
“
M
a
c
h
in
e
Lea
rn
in
g
,”
In
telli
g
e
n
t
S
y
ste
ms
.
In
telli
g
e
n
t
S
y
ste
ms
Refe
re
n
c
e
L
ib
ra
ry
,
vol
.
1
7
,
2
0
1
1
,
d
o
i:
1
0
.
1
0
0
7
/9
7
8
-
3
-
6
4
2
-
2
1
0
0
4
-
4
_
1
0
.
[2
5
]
P
.
Ch
a
n
d
ra
se
k
a
r,
K.
Qia
n
,
H.
S
h
a
h
riar,
a
n
d
P
.
B
h
a
tt
a
c
h
a
ry
a
,
“
Im
p
r
o
v
i
n
g
th
e
P
re
d
icti
o
n
Ac
c
u
ra
c
y
o
f
De
c
isio
n
Tree
M
in
i
n
g
with
Da
ta
P
re
p
r
o
c
e
ss
in
g
,
”
p
re
se
n
ted
a
t
t
h
e
2
0
1
7
I
EE
E
4
1
st
An
n
u
a
l
C
o
mp
u
ter
S
o
ft
w
a
re
a
n
d
A
p
p
l
ica
ti
o
n
s
Co
n
fer
e
n
c
e
(COM
P
S
AC)
,
J
u
l.
2
0
1
7
,
d
o
i:
1
0
.
1
1
0
9
/CO
M
P
S
AC.
2
0
1
7
.
1
4
6
.
[2
6
]
I.
S
h
a
ra
fa
ld
in
,
A.
Ha
b
i
b
i
Las
h
k
a
ri,
a
n
d
A.
G
h
o
r
b
a
n
i,
“
To
wa
rd
G
e
n
e
ra
ti
n
g
a
Ne
w
I
n
tr
u
sio
n
De
tec
ti
o
n
Da
tas
e
t
a
n
d
In
tru
si
o
n
Traffic
Ch
a
ra
c
teriz
a
ti
o
n
,
”
4
th
In
ter
n
a
ti
o
n
a
l
C
o
n
fer
e
n
c
e
o
n
In
f
o
rm
a
ti
o
n
S
y
ste
ms
S
e
c
u
r
it
y
a
n
d
Priva
c
y
(ICIS
S
P),
P
o
rtu
g
a
l,
Ja
n
u
a
ry
2
0
1
8
.
Evaluation Warning : The document was created with Spire.PDF for Python.