T
E
L
KO
M
NIK
A
, V
ol
.
17
,
No.
4,
A
ug
us
t
20
1
9,
p
p.1
706
~1
714
IS
S
N: 1
69
3
-
6
93
0
,
accr
ed
ited
F
irst
Gr
ad
e b
y K
em
en
r
istekdikti,
Decr
ee
No: 2
1/E/
K
P
T
/20
18
DOI:
10.12928/TE
LK
OM
N
IK
A
.v
1
7
i
4
.
12065
17
06
Rec
ei
v
ed
Dec
e
mb
er
15
,
20
1
8
; R
ev
i
s
ed
Ma
r
c
h 2
6
, 2
01
9
; A
c
c
ep
t
ed
A
pri
l
23
,
20
1
9
Pre
-
filt
er
s in
-
tra
nsit
mal
w
are pa
ckets
det
ec
tio
n in
th
e
net
w
ork
Ban M
o
h
amm
ed Kh
amm
a
s*
1
, I
smahan
i
Is
m
ail
2
,
M.
N. M
ar
son
o
3
1
Dep
a
rt
m
e
n
t
o
f
Net
w
o
rk
s
En
g
i
n
e
e
ri
n
g
,
Co
l
l
a
g
e
o
f
I
n
fo
r
m
a
t
i
o
n
En
g
i
n
e
e
r
i
n
g
,
AL
-
Nah
ra
i
n
Un
i
v
e
r
s
i
ty
,
Ba
g
h
d
a
d
,
Ira
q
2
,3
Fa
c
u
l
ty
o
f
El
e
c
tri
c
a
l
E
n
g
i
n
e
e
ri
n
g
,
Un
i
v
e
rs
i
ti
T
e
k
n
o
l
o
g
i
M
a
l
a
y
s
i
a
,
J
o
h
o
r B
a
h
ru
,
J
o
h
o
r M
a
l
a
y
s
i
a
*C
o
rre
s
p
o
n
d
i
n
g
a
u
th
o
r,
e
-
m
a
i
l
:
b
a
n
k
h
a
m
m
a
s
@c
o
i
e
-
n
a
h
ra
i
n
.e
d
u
.i
q
Ab
strac
t
Con
v
e
n
ti
o
n
a
l
m
a
l
ware
d
e
te
c
t
i
o
n
s
y
s
te
m
s
c
a
n
n
o
t
d
e
t
e
c
t
m
o
s
t
o
f
th
e
n
e
w
m
a
l
war
e
i
n
t
h
e
n
e
two
rk
wit
h
o
u
t
th
e
a
v
a
i
l
a
b
i
l
i
ty
o
f
th
e
i
r
s
i
g
n
a
tu
r
e
s
.
I
n
o
rd
e
r
to
s
o
l
v
e
t
h
i
s
p
ro
b
l
e
m
,
th
i
s
p
a
p
e
r
p
r
o
p
o
s
e
s
a
te
c
h
n
i
q
u
e
to
d
e
t
e
c
t
b
o
t
h
m
e
ta
m
o
rp
h
i
c
(
m
u
ta
te
d
m
a
l
war
e
)
a
n
d
g
e
n
e
r
a
l
(n
o
n
-
m
u
ta
te
d
)
m
a
l
ware
i
n
th
e
n
e
two
r
k
u
s
i
n
g
a
c
o
m
b
i
n
a
ti
o
n
o
f
k
n
o
wn
m
a
l
wa
re
s
u
b
-
s
i
g
n
a
t
u
re
a
n
d
m
a
c
h
i
n
e
l
e
a
r
n
i
n
g
c
l
a
s
s
i
f
i
c
a
ti
o
n
.
Th
i
s
n
e
two
rk
-
b
a
s
e
d
m
a
l
ware
d
e
te
c
ti
o
n
i
s
a
c
h
i
e
v
e
d
th
ro
u
g
h
a
m
i
d
d
l
e
p
a
th
fo
r
e
ff
i
c
i
e
n
t
p
ro
c
e
s
s
i
n
g
o
f
n
o
n
-
m
a
l
ware
p
a
c
k
e
t
s
.
Th
e
p
ro
p
o
s
e
d
te
c
h
n
i
q
u
e
h
a
s
b
e
e
n
te
s
te
d
a
n
d
v
e
ri
fi
e
d
u
s
i
n
g
m
u
l
ti
p
l
e
d
a
ta
s
e
t
s
(m
e
ta
m
o
rp
h
i
c
m
a
l
war
e
,
non
-
m
u
ta
t
e
d
m
a
l
war
e
,
a
n
d
UTM
re
a
l
tra
ff
i
c
)
,
th
i
s
t
e
c
h
n
i
q
u
e
c
a
n
d
e
te
c
t
m
o
s
t
o
f
m
a
l
ware
p
a
c
k
e
ts
i
n
th
e
n
e
two
rk
-
b
a
s
e
d
b
e
fo
re
th
e
y
re
a
c
h
e
d
th
e
h
o
s
t
b
e
tt
e
r
t
h
a
n
th
e
p
r
e
v
i
o
u
s
work
s
whi
c
h
d
e
te
c
t
m
a
l
ware
i
n
h
o
s
t
-
b
a
s
e
d
.
E
x
p
e
r
i
m
e
n
ta
l
re
s
u
l
ts
s
h
o
wed
th
a
t
th
e
p
ro
p
o
s
e
d
te
c
h
n
i
q
u
e
c
a
n
s
p
e
e
d
u
p
th
e
tra
n
s
m
i
s
s
i
o
n
o
f
m
o
re
th
a
n
9
8
%
n
o
rm
a
l
p
a
c
k
e
ts
wit
h
o
u
t
s
e
n
d
i
n
g
th
e
m
to
t
h
e
s
l
o
w
p
a
th
,
a
n
d
m
o
re
th
a
n
9
7
%
o
f
m
a
l
war
e
p
a
c
k
e
t
s
a
re
d
e
te
c
te
d
a
n
d
d
r
o
p
p
e
d
i
n
th
e
m
i
d
d
l
e
p
a
t
h
.
F
u
rth
e
rm
o
re
,
m
o
re
th
a
n
7
5
%
o
f
m
e
ta
m
o
rp
h
i
c
m
a
l
ware
p
a
c
k
e
t
s
i
n
th
e
t
e
s
t
d
a
ta
s
e
t
c
o
u
l
d
b
e
d
e
te
c
te
d
.
T
h
e
p
ro
p
o
s
e
d
te
c
h
n
i
q
u
e
i
s
3
7
t
i
m
e
s
fa
s
te
r
t
h
a
n
e
x
i
s
ti
n
g
t
e
c
h
n
i
q
u
e
.
Key
w
ords
:
m
a
l
ware
d
e
t
e
c
t
i
o
n
,
m
i
d
d
l
e
p
a
t
h
,
n
e
two
rk
s
e
c
u
ri
t
y
,
SVM
Copy
righ
t
©
2
0
1
9
Uni
v
e
rsi
t
a
s
Ahm
a
d
D
a
hl
a
n.
All
rig
ht
s
r
e
s
e
rve
d
.
1.
Int
r
o
d
u
ctio
n
C
y
b
er
s
ec
urit
y
a
pp
e
ared
a
s
great
c
on
c
ern
f
or
the
op
erati
o
ns
of
i
ns
ti
tut
i
o
ns
i
nc
l
ud
i
ng
go
v
ernm
en
ts
,
ba
nk
s
,
bu
s
i
ne
s
s
,
as
w
e
l
l
as
pri
v
a
te
us
ers
,
w
h
ere
m
as
s
i
v
e
am
ou
nt
of
s
en
s
i
ti
v
e
i
nf
orm
ati
on
i
n
the
f
or
m
of
da
ta
are
c
on
ti
n
ua
l
l
y
m
i
ne
d.
Ma
n
y
c
h
al
l
en
ge
s
h
av
e
a
p
pe
are
d,
o
ne
of
the
s
e
c
ha
l
l
en
ge
s
i
s
t
o
pre
v
en
t
t
he
s
pre
ad
of
m
al
war
e
throu
gh
t
he
I
nte
r
n
et,
whi
c
h
i
s
f
r
eq
ue
ntl
y
en
ha
nc
ed
o
v
er
the
y
e
ars
.
T
hu
s
,
ac
c
urate
an
d
ef
f
i
c
i
en
t
de
t
ec
ti
o
n
s
y
s
tem
s
be
c
am
e
an
ab
s
ol
ut
e
ne
ed
to
r
ec
og
n
i
z
e
t
he
m
al
war
e
as
s
i
s
te
d
at
tac
k
s
tha
t
oc
c
ur
i
n
t
he
ne
t
wor
k
an
d
c
om
pu
ter
s
y
s
t
em
.
A
c
c
ordi
n
g
to
S
y
m
an
tec
r
e
p
ort
i
n
20
16
,
m
al
w
are
tha
t
s
pread
c
urr
e
ntl
y
i
n
t
he
ne
t
wor
k
s
i
s
hi
g
hl
y
m
uta
ted
an
d c
on
t
i
nu
ou
s
l
y
u
pd
at
i
ng
th
em
i
n o
r
d
er to
av
oi
d c
o
nv
en
t
i
on
al
de
t
ec
ti
o
n
s
y
s
t
em
s
[
1
]
.
E
x
i
s
ti
n
g
tec
h
ni
qu
es
[
2
,
3
]
t
r
y
to
d
ete
c
t
th
e
att
ac
k
s
or
m
al
w
are
i
n
th
e
ne
t
wor
k
ex
c
l
ud
i
ng
m
eta
m
orphi
c
m
al
w
are.
M
et
am
orphi
c
m
al
w
are
of
ten
c
h
an
ge
s
th
ei
r
s
tr
uc
ture
or
bo
d
y
of
c
od
es
i
n
ea
c
h
i
nf
ec
ti
o
n,
m
a
k
i
ng
th
e
de
tec
t
i
on
d
i
f
fi
c
ul
t
or
i
ne
ff
ec
ti
v
e
[
4
-
6
]
.
S
i
gn
a
ture
-
b
a
s
ed
tec
hn
i
qu
e
c
an
no
t
de
tec
t
t
he
m
du
e
to
the
i
r
s
op
h
i
s
ti
c
at
ed
s
tr
ate
g
y
tha
t
a
v
o
i
ds
s
i
gn
atu
r
e
i
d
en
t
i
fi
c
ati
o
n
[
7
-
9
]
.
Dete
c
ti
on
of
the
s
e
ne
w
n
et
wor
k
-
ba
s
ed
m
al
w
are
be
f
or
e
i
t
r
ea
c
h
es
th
e
h
os
t
t
ha
t
p
os
ed
n
on
-
tr
i
v
i
al
c
ha
l
l
en
g
es
[
10
,
11
]
.
Mo
s
t
of
the
pre
v
i
o
us
r
es
ea
r
c
h
es
[
4
-
6
]
h
av
e
be
en
d
ed
i
c
ate
d
t
o
de
tec
t
m
eta
m
orphi
c
m
al
war
e
a
t
the
ho
s
t
-
l
e
v
e
l
,
whi
c
h
r
eq
u
i
r
ed
c
o
de
di
s
as
s
em
bl
y
.
T
hu
s
,
th
ei
r
i
m
pl
em
en
tat
i
on
c
an
no
t
b
e
m
ad
e
v
i
ab
l
e
i
n
t
he
n
et
wor
k
s
i
nc
e
i
t
i
s
i
m
po
s
s
i
bl
e
to
de
tec
t
a
l
l
pa
y
l
o
ad
c
on
ten
ts
.
T
he
de
tec
ti
on
of
m
al
w
are
i
n
t
he
ne
t
wor
k
-
l
ev
el
i
s
d
i
f
fi
c
ul
t
du
e
t
o
th
e
n
ee
d
f
or
fl
ow
s
proc
es
s
[
12
-
19
]
.
V
argh
es
e
et
al
.
[
12
]
pro
po
s
ed
a
f
as
t
-
s
l
o
w
p
ath
tec
h
ni
qu
e
t
o
de
t
ec
t
the
att
ac
k
i
n
the
ne
t
w
ork
-
l
ev
e
l
.
Ho
wev
er
,
hi
g
h
pe
r
c
en
t
ag
e
of
no
r
m
al
pa
c
k
ets
ne
ed
to
be
s
e
nt
to
the
s
l
o
w
pa
th
tha
t
d
el
a
y
th
e
tr
an
s
f
orm
ati
on
of
the
ne
t
w
ork
tr
affi
c
w
hi
c
h
ne
ed
t
o
be
a
dd
r
es
s
e
d
thi
s
pro
bl
em
.
A
l
s
o,
i
t
i
s
es
s
en
ti
al
to
de
v
e
l
op
a
n
e
w
de
tec
t
i
on
tec
h
ni
q
ue
t
o
pre
v
en
t
the
s
prea
di
n
g
of
m
al
w
are
i
n
the
n
et
w
ork
be
f
ore
i
t
r
ea
c
h
i
ng
t
o
th
e
ho
s
t
wi
th
ou
t
s
en
di
n
g
a
l
ot
of
no
r
m
al
pa
c
k
ets
to
the
s
l
o
w
path.
T
he
r
es
t
of
thi
s
p
ap
e
r
i
s
organ
i
z
ed
as
f
ol
l
o
w
s
:
s
ec
ti
on
2
pro
v
i
de
s
a
c
om
prehen
s
i
v
e
an
d
c
r
i
ti
c
al
l
i
ter
atu
r
e
r
e
v
i
e
w
.
S
ec
ti
on
3
d
es
c
r
i
be
s
prop
os
ed
ne
t
wor
k
-
ba
s
ed
m
al
war
e
de
t
ec
ti
o
n
Evaluation Warning : The document was created with Spire.PDF for Python.
T
E
L
KO
M
NIK
A
IS
S
N: 1
69
3
-
6
93
0
P
r
e
-
fi
l
ters
i
n
-
tr
an
s
i
t
ma
l
war
e p
ac
k
ets
d
ete
c
ti
on
i
n t
he
n
etwo
r
k
...(
B
an
Mo
h
am
m
ed
K
ha
mm
as
)
1707
tec
hn
i
qu
e
.
In
ad
d
i
t
i
on
,
t
he
de
tai
l
s
of
da
ta
c
ol
l
ec
ti
o
n
tha
t
us
ed
i
n
thi
s
w
ork
are
pres
en
ted
i
n
s
ec
ti
on
4.
S
ec
ti
on
5
a
na
l
y
z
es
th
e
r
es
ul
ts
an
d
m
ea
s
ures
the
m
al
w
ar
e
d
ete
c
ti
on
ab
i
l
i
t
y
of
the
prop
os
ed
tec
h
ni
qu
e
i
n
t
he
ne
t
wor
k
to
ho
l
d
the
s
pre
ad
of
m
al
w
ar
e
i
n
th
e
r
ea
l
n
et
w
ork
tr
affi
c
.
A
l
s
o
i
n
thi
s
s
ec
ti
on
,
t
h
e
s
pe
ed
u
p
of
the
propos
e
d
m
eth
od
i
s
m
ea
s
ured
an
d
hi
g
hl
i
gh
ted
.
S
ec
ti
on
6
c
on
c
l
ud
e
s
t
he
p
a
pe
r
.
2.
Rel
ated
W
o
r
k
s
O
v
er
the
y
e
ars
,
ne
t
w
ork
att
ac
k
s
are
c
on
du
c
ted
to
di
s
r
up
t,
de
grad
e,
de
n
y
,
or
d
es
tr
o
y
i
nf
orm
ati
on
r
es
i
de
nt
i
n
c
om
pu
ters
an
d
c
om
pu
ter
ne
t
wo
r
k
s
[
20
]
.
Dete
c
ti
n
g
ne
t
wor
k
att
ac
k
s
us
i
ng
ne
t
w
ork
i
ntrus
i
on
de
tec
ti
on
s
y
s
tem
(
NIDS
)
d
ep
e
nd
s
on
t
he
att
ac
k
t
y
pe
s
a
nd
th
e
us
er’s
go
al
,
whi
c
h
i
s
di
v
i
de
d
i
nt
o
t
w
o
a
pp
r
oa
c
h
es
.
F
i
r
s
t
i
s
the
f
l
o
w
i
ns
pe
c
t
i
on
an
d
s
ec
on
d
i
s
de
ep
p
ac
k
et
i
ns
pe
c
t
i
on
(
D
P
I)
.
T
he
f
l
o
w
i
ns
p
ec
ti
o
n
d
ea
l
s
wi
th
t
he
at
tac
k
s
tha
t
de
v
i
ate
f
r
om
the
no
r
m
al
ne
t
w
ork
tr
aff
i
c
be
ha
v
i
or.
Us
ua
l
l
y
,
th
i
s
t
y
p
e
of
att
ac
k
a
ff
ec
ts
the
w
ho
l
e
ne
t
wor
k
s
tat
es
an
d
pe
r
f
or
m
an
c
e
s
uc
h
as
Den
i
al
-
of
-
S
er
v
i
c
e
at
tac
k
(
DoS
)
.
DP
I
m
on
i
tors
the
pa
c
k
et
c
on
ten
t
an
d
s
ea
r
c
h f
o
r
th
e p
r
es
e
nc
e o
f
an
y
un
au
th
ori
z
ed
c
od
e,
m
a
l
w
are c
o
de
,
an
d
m
al
w
are
f
i
ng
erpr
i
nts
[
21
]
.
Ma
n
y
de
di
c
at
ed
ef
f
orts
are
m
ad
e
to
de
t
ec
t
att
ac
k
or
m
al
w
are
i
n
ne
t
wor
k
b
y
c
o
m
bi
ni
ng
the
ML
wi
t
h
S
no
r
t
s
i
g
na
tur
es
[
22
-
25
]
.
De
Li
m
a
et
al
.
[
22
]
ex
tr
ac
te
d
t
he
f
ea
t
ure
of
att
ac
k
an
d
be
n
i
gn
f
i
l
es
f
r
o
m
the
pa
c
k
et
f
l
ow
s
.
T
he
y
m
en
ti
on
ed
th
at
m
os
t
o
f
the
ne
w
att
ac
k
c
ar
r
i
ed
an
d
us
ed
the
s
tr
at
eg
y
s
i
m
i
l
ar
t
o
t
he
s
tr
ate
g
y
of
the
i
r
pre
de
c
e
s
s
ors
,
w
h
i
c
h
i
m
pl
i
es
th
e
att
ac
k
s
ha
r
ed
the
s
am
e
f
ea
tures
.
B
as
ed
on
thi
s
f
ac
t
the
ne
ura
l
ne
t
wor
k
i
s
tr
ai
ne
d
to
i
d
en
t
i
f
y
ne
w
att
ac
k
,
w
hi
c
h
i
s
i
m
pl
e
m
en
ted
on
a
M
LP
25
6
-
21
-
1
ne
t
wor
k
to
ac
hi
ev
e
de
t
ec
ti
on
ac
c
urac
y
ab
o
ut
74
%.
O
the
r
r
es
ea
r
c
h
s
uc
h
as
[
23
,
24
]
us
ed
ne
ura
l
n
et
w
ork
(
NN)
i
n
a
tta
c
k
de
tec
ti
o
n
an
d
ex
tr
ac
t
ed
the
f
ea
t
ure
of
at
tac
k
an
d
b
en
i
gn
f
r
om
the
pa
c
k
et
c
on
t
en
t.
T
he
y
c
om
bi
ne
d
th
e
Ha
m
m
i
ng
Net
NN
(
HNNN
)
w
i
t
h
46
S
n
ort
s
i
g
na
tures
f
or
tr
ai
ni
n
g
to
c
l
as
s
i
f
y
t
he
i
l
l
eg
i
ti
m
ate
i
nf
or
m
ati
on
i
n
T
CP
/I
P
pa
c
k
et
pa
y
l
oa
d.
In
s
o
m
e
ne
twork
i
ntrus
i
on
de
tec
ti
o
n,
the
r
es
ea
r
c
he
r
s
us
ed
an
om
al
y
d
ete
c
t
i
on
an
d
n
-
gram
f
ea
tures
are
ex
tr
ac
ted
,
t
he
y
s
ho
wn
th
at
n
-
gram
an
al
y
s
i
s
i
s
no
t
on
l
y
ef
f
i
c
i
en
t
f
or
the
m
al
w
are
d
ete
c
ti
on
bu
t
al
s
o
c
ap
a
bl
e
of
de
tec
t
i
ng
d
i
f
f
erent
t
y
pe
s
of
att
ac
k
s
[
3
,
25
-
32
]
.
Ri
ec
k
an
d
La
s
k
ov
[
27
]
pro
po
s
e
d
a
m
eth
od
us
i
n
g
l
a
ng
u
a
ge
m
od
el
s
tha
t
ex
tr
ac
ted
f
ea
tures
f
r
o
m
pa
y
l
o
ad
us
i
ng
v
aria
bl
e
l
en
gth
of
n
-
gram
s
.
T
he
y
ap
p
l
i
e
d
u
ns
up
er
v
i
s
e
d
a
no
m
al
y
d
ete
c
ti
on
to
de
tec
t
att
a
c
k
on
the
T
CP
c
on
n
ec
ti
o
n
i
n
ap
p
l
i
c
a
ti
on
l
a
y
er.
Us
i
n
g
c
l
us
teri
ng
a
l
go
r
i
thm
s
an
d
s
tat
i
s
ti
c
a
l
an
al
y
s
i
s
,
a
d
ete
c
ti
on
ac
c
urac
y
o
v
er
80
%
i
s
ac
hi
e
v
e
d
w
i
t
h
no
F
P
R.
Is
m
ai
l
et
al
.
[
25
]
propos
e
d c
on
t
en
t
-
b
as
ed
d
e
tec
ti
o
n o
f
ne
w
m
al
w
are
at
t
he
n
et
w
ork
i
nf
r
as
tr
uc
ture l
e
v
e
l
.
A
s
af
orem
en
ti
on
ed
,
de
t
ec
ti
ng
att
ac
k
s
i
n
t
he
ne
t
wor
k
r
eq
ui
r
es
c
aref
ul
c
o
ns
i
de
r
at
i
on
of
pa
c
k
et
an
d
f
l
ow
proc
es
s
i
n
g
[
12
]
.
V
ar
gh
es
e
et
a
l
.
[
12
]
propo
s
ed
a
tec
hn
i
q
ue
to
de
tec
t
e
v
as
i
o
n
att
ac
k
s
w
i
th
ou
t
r
e
as
s
em
bl
y
of
T
CP
f
l
ow
s
.
T
he
k
no
wn
att
ac
k
s
i
gn
at
ures
are
d
i
v
i
de
d
i
nto
f
i
x
ed
s
ub
-
s
i
gn
a
ture
to
de
tec
t
i
ng
the
m
i
n
the
i
nc
om
i
ng
pa
c
k
et
us
i
n
g
s
tr
i
ng
m
atc
hi
ng
.
A
f
as
t
pa
th
an
d
s
l
o
w
p
ath
f
r
am
ew
ork
i
s
pro
po
s
ed
t
o
i
m
prov
e
th
e
d
ete
c
ti
on
s
p
ee
d
an
d
m
i
ni
m
i
z
e
t
he
m
e
m
or
y
.
In
the
f
as
t
pa
th,
t
he
i
nc
om
i
ng
pa
c
k
et
i
s
i
ns
pe
c
ted
f
or
c
on
tai
ni
ng
a
n
y
p
i
ec
e
of
s
ub
-
s
i
gn
atu
r
e
(
af
ter
di
v
i
d
ed
th
e
s
i
g
na
tur
e
to
f
i
x
ed
s
i
z
e
4
b
y
te)
us
i
ng
a
n
y
m
atc
hi
ng
al
g
orit
hm
s
.
T
he
n
thi
s
pa
c
k
et
i
s
s
en
t
to
s
l
o
w
pa
th
t
o
r
e
as
s
em
bl
e
the
pa
c
k
ets
f
or
ge
tti
n
g
a
l
l
f
l
o
w
a
nd
m
ak
i
ng
de
e
p
er
an
a
l
y
s
i
s
at
the
ho
s
t
t
o
de
c
i
de
i
f
i
t
i
s
a
n
att
ac
k
or
no
t.
T
he
y
de
s
c
r
i
be
d
tha
t
the
pa
c
k
et
i
s
i
ns
p
ec
ted
thro
ug
h
m
an
y
c
h
i
ps
i
n
no
r
m
al
ID
S
/I
P
S
an
d
t
he
T
CP
an
d
I
P
f
l
o
w
s
tat
e
i
s
s
tor
ed
i
n
l
ar
ge
s
t
ate
t
ab
l
e
wi
t
h
hu
ge
m
e
m
or
y
f
or
C
c
on
n
ec
ti
on
s
a
nd
W
bi
ts
pe
r
c
on
ne
c
t
i
on
.
T
he
m
i
ni
m
u
m
s
tat
e
f
or
f
l
ow
c
on
ne
c
ti
on
i
s
5
-
tup
l
e
an
d
the
s
eq
ue
nc
e
nu
m
be
r
i
s
at
l
ea
s
t
12
8
bi
ts
.
T
hu
s
,
the
m
i
ni
m
u
m
m
e
m
or
y
r
eq
ui
r
e
d
i
s
1
28
M
bi
ts
f
or
on
e
m
i
l
l
i
o
n
c
on
n
ec
ti
on
s
,
w
h
i
c
h
i
s
s
uff
i
c
i
en
tl
y
l
arge
.
T
he
r
ea
s
s
em
bl
y
of
the
T
CP
an
d
IP
pa
c
k
ets
i
n
ne
t
w
ork
i
ntrus
i
o
n
pre
v
e
nti
o
n
s
y
s
t
em
s
(
NIP
S
)
i
s
ex
pe
n
s
i
v
e
be
c
au
s
e
i
t
ne
ed
s
t
o
k
ee
p
tr
ac
k
f
or
m
i
l
l
i
o
ns
of
c
on
ne
c
ti
on
s
.
H
o
w
e
v
er,
us
i
ng
a
s
ep
ar
ate
f
as
t
pa
th
an
d
s
l
o
w
pa
th,
th
e
s
pe
ed
of
the
pa
c
k
et
pa
s
s
i
n
g
i
n
t
he
r
ou
ter
c
an
be
i
nc
r
ea
s
e
d
ar
ou
n
d
10
ti
m
es
tha
n
the
t
i
m
e
ne
ed
e
d
f
or
de
t
ec
ti
on
i
n
l
a
y
er
7.
A
l
th
ou
g
h
i
t
i
s
po
s
s
i
b
l
e
t
o
ex
tr
ac
t
n
-
gram
f
ea
tures
an
d
c
l
as
s
i
f
i
c
ati
on
o
n
i
nd
i
v
i
du
a
l
pa
c
k
et
pa
y
l
o
ad
,
ef
f
i
c
i
e
nt
arc
hi
tec
ture
i
s
ne
ed
e
d
to
ad
dres
s
non
-
m
al
war
e p
ac
k
ets
.
B
ou
k
hto
ut
a
et
al
.
[
2
]
c
om
pa
r
ed
th
e
pa
c
k
et
he
ad
er
f
ea
tures
w
i
th
DP
I
f
or
de
t
ec
ti
ng
m
al
w
are
i
n
the
ne
t
w
ork
l
ev
el
.
T
ota
l
2
2
f
l
o
w
he
ad
er
f
ea
tures
are
ex
tr
ac
ted
an
d
t
he
n
d
i
f
f
erent
ML
tec
hn
i
qu
e
i
s
us
ed
to
c
l
as
s
i
f
y
the
p
ac
k
et
he
ad
er
us
i
n
g
W
E
K
A
.
E
x
pe
r
i
m
en
tal
r
es
ul
t
s
r
ev
ea
l
ed
th
at
J
48
an
d
B
oo
s
te
d
J
48
pro
du
c
ed
t
he
be
s
t
o
utc
om
e.
Mo
de
l
s
f
or
di
f
f
erent
m
al
w
a
r
e
f
a
m
i
l
i
es
are
c
r
ea
ted
us
i
ng
H
MM
.
F
or
D
P
I,
c
om
pl
ete
c
ap
t
ures
(
pc
a
ps
)
i
s
us
ed
to
i
nj
ec
t
i
t
to
th
e
m
od
el
c
al
l
ed
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N: 16
93
-
6
93
0
T
E
L
KO
M
NIK
A
V
ol
.
17
,
No
.
4
,
A
ug
us
t
20
19
:
1
70
6
-
1
7
14
1708
MA
RF
P
CA
T
(
Mo
d
ul
ar
A
u
di
o
Rec
og
ni
t
i
o
n
F
r
am
ew
ork
-
ba
s
ed
P
CA
P
A
na
l
y
s
i
s
too
l
)
.
E
ac
h
pc
ap
i
s
l
oa
de
d
t
o
tha
t
t
oo
l
,
w
he
r
e
a
s
i
gn
a
l
i
s
i
n
terpr
et
ed
as
a
w
a
v
ef
orm
.
T
he
s
i
gn
al
e
nc
l
os
ed
the
f
l
o
w
s
wi
th
bo
t
h
t
he
he
a
de
r
an
d
p
a
y
l
oa
d.
R
es
ul
ts
s
h
o
w
e
d
th
at
7
71
ou
t
of
1,0
63
m
al
w
ar
e
c
l
as
s
es
are
c
l
as
s
i
f
i
ed
wi
th
10
0%
ac
c
urac
y
a
nd
t
he
r
es
t p
r
od
uc
e
d t
he
ac
c
urac
y
l
o
wer
th
an
75
%.
3.
P
r
o
p
o
se
d
N
etw
o
r
k
-
Bas
ed
M
al
w
ar
e De
t
ec
t
ion
T
ec
h
n
iqu
e
A
c
c
urate
d
ete
c
ti
on
of
m
al
war
e
at
t
he
n
et
w
ork
l
ev
el
r
e
qu
i
r
es
i
m
prov
ed
i
n
th
e
tec
h
ni
q
ue
.
Rec
en
t
r
es
ea
r
c
h
es
r
ev
e
al
ed
tha
t
ho
s
t
-
b
as
ed
M
L
c
l
a
s
s
i
fi
c
ati
on
c
an
d
ete
c
t
m
al
war
e
w
i
t
h
h
i
gh
de
tec
t
i
on
ac
c
urac
y
.
T
he
proc
es
s
m
us
t
be
ac
c
el
er
ate
d
[
12
]
t
o
o
v
erc
om
e
th
e
l
i
m
i
tat
i
o
ns
of
de
tec
t
i
ng
m
al
war
e
at
the
p
ac
k
et
l
ev
el
.
F
r
om
thi
s
v
i
e
w
,
thi
s
pa
pe
r
prop
os
es
a
s
tr
ate
g
y
t
o
de
tec
t
the
m
al
war
e
c
on
te
nts
at
t
he
ne
t
wor
k
l
ev
e
l
as
the
fi
r
s
t
l
i
ne
of
de
f
en
s
e
to
pr
ote
c
t
s
y
s
tem
s
c
on
ne
c
te
d
to
n
et
w
ork
fr
o
m
be
i
n
g
i
nf
ec
ted
,
th
i
s
i
s
the
m
ai
n
c
on
tr
i
bu
t
i
on
of
c
urr
en
t
s
tud
y
.
T
hi
s
tec
hn
i
qu
e
c
a
n
be
i
m
pl
em
en
te
d
i
n
m
i
dd
l
e
-
bo
x
es
p
l
a
c
ed
ne
ar
e
dg
e
r
ou
ter
t
o
protec
t
s
y
s
tem
c
on
ne
c
te
d t
o
ne
t
wor
k
fro
m
m
al
w
are s
pre
ad
.
E
arl
i
er
m
eth
od
s
[
33
]
are
e
nh
an
c
e
d
b
y
m
as
k
i
ng
S
no
r
t
s
ub
-
s
i
gn
atu
r
es
an
d
us
i
ng
ter
m
f
r
eq
ue
nc
y
of
m
al
w
are
f
ea
t
ures
.
T
he
propos
ed
m
eth
od
us
es
ex
tr
ac
te
d
n
-
gram
f
ea
tures
fr
o
m
the
c
on
te
nt
of
the
bi
na
r
i
es
an
d
fi
l
tere
d
the
nu
m
be
r
of
n
-
gram
f
ea
tures
b
y
m
as
k
i
ng
th
es
e
f
ea
tures
wi
th
S
n
ort
s
ub
-
s
i
g
n
at
ure.
S
no
r
t
r
u
l
es
ar
e
us
ed
f
or
ne
t
w
ork
i
ntrus
i
o
n
de
tec
ti
on
s
y
s
t
em
.
O
the
r
s
r
ul
es
s
uc
h
as
B
r
o
or
S
uric
a
ta
c
an
be
us
ed
as
wel
l
.
IG
f
ea
ture
s
el
ec
ti
o
n
m
eth
od
[
34
]
i
s
em
pl
o
y
e
d
to
s
el
ec
t
on
l
y
th
e
i
m
po
r
tan
t
f
ea
tures
as
a
s
ec
on
d
-
l
e
v
e
l
fi
l
ter.
T
hi
s
al
l
o
w
ed
th
e
S
V
M
c
l
as
s
i
fi
er
to
f
oc
us
on
l
y
o
n
the
s
i
gn
i
fi
c
an
t m
al
w
are
f
ea
tures
.
T
he
pro
c
es
s
i
ng
of
ne
t
w
ork
tr
af
fi
c
c
an
be
do
n
e
on
a
pa
c
k
et
ba
s
ed
,
where
i
nd
i
v
i
du
a
l
pa
c
k
ets
are
s
ub
j
ec
ted
to
ML
c
l
as
s
i
fi
c
ati
on
of
n
-
gram
f
ea
tures
to
de
tec
t th
e p
r
es
e
nc
e o
f
m
al
w
ar
e.
P
r
ev
i
o
us
wor
k
b
y
V
argh
e
s
e
et
al
.
[
12
,
13
]
s
ug
g
es
ted
a
f
as
t/
s
l
o
w
p
ath
t
ec
h
ni
q
ue
.
T
he
c
urr
en
t
pa
pe
r
ex
te
nd
s
the
pre
v
i
ou
s
wor
k
[
12
,
13
]
b
y
ad
d
i
n
g
a
m
i
dd
l
e
p
ath
t
o
h
an
d
l
e
non
-
m
al
war
e
p
ac
k
ets
c
l
as
s
i
fi
c
ati
on
.
In
c
urr
e
nt
p
ap
er,
m
i
dd
l
e
p
ath
t
ec
hn
i
q
ue
c
o
m
po
s
ed
of
ML
an
d
S
no
r
t
s
u
b
-
s
i
gn
atu
r
e
as
the
m
ai
n
f
ea
tures
t
o
be
s
e
arc
he
d
i
n
th
e
p
ac
k
et
pa
y
l
o
ad
f
or
ac
c
urate
de
tec
t
i
on
of
ne
w
m
al
war
e
an
d
m
eta
m
orphi
c
m
al
w
are
.
T
he
l
oc
at
i
o
n
of
th
e
m
i
dd
l
e
-
bo
x
i
s
p
l
ac
e
d
ne
ar
th
e
e
dg
e
r
o
ute
r
.
T
he
pres
en
t
ap
proac
h
f
ol
l
o
w
s
th
e
e
arli
er
m
eth
od
s
[
12
,
25
]
w
h
ere
the
d
ete
c
ti
on
s
y
s
t
em
i
s
ba
s
ed
on
pa
c
k
ets
.
T
he
pres
en
t
wor
k
i
s
the
ex
ten
s
i
o
n
to
[
9
,
25
]
wor
k
,
b
y
i
ntrod
uc
i
n
g
the
m
i
dd
l
e
pa
th
tec
hn
i
qu
e
us
i
ng
S
V
M
c
l
as
s
i
fi
er.
A
l
s
o
t
he
pro
bl
em
of
t
he
l
ar
ge
s
i
z
e
of
n
-
gram
i
s
s
ol
v
ed
us
i
n
g f
ea
t
ure s
el
ec
t
i
o
n m
eth
od
to
c
h
oo
s
e o
nl
y
1
00
0 f
ea
t
ures
.
T
he
ba
s
e
of
the
pro
po
s
e
d
tec
hn
i
qu
e
i
s
[
12
]
tec
h
ni
qu
e
.
T
he
props
ed
t
ec
hn
i
qu
e
i
n
c
l
ud
e
the
f
as
t
pa
t
h
w
h
i
c
h
c
on
t
ai
ns
a
n
y
pa
tt
ern
m
atc
hi
n
g
al
go
r
i
t
hm
s
uc
h
as
K
nu
thM
orr
i
s
-
P
r
a
tt,
A
ho
-
C
oras
i
c
k
,
an
d W
u
-
Ma
nb
er
[
35
]
th
at
s
c
an
s
th
e
c
o
nte
nt
of
i
nc
om
i
ng
pa
c
k
et
p
a
y
l
oa
d
to
de
tec
t
the
pres
e
nc
e
of
an
y
s
ub
-
s
i
gn
at
ure.
S
ec
on
d
l
y
,
up
on
d
ete
c
ti
on
,
th
e
pa
c
k
et
i
s
s
en
t
to
the
m
i
dd
l
e
pa
th.
T
he
m
i
dd
l
e
pa
t
h
i
s
t
he
m
ai
n
f
oc
us
of
att
en
ti
o
n
(
c
al
l
e
d
m
i
dd
l
e
b
ox
)
of
the
pres
en
t
p
ap
er.
It
c
l
a
s
s
i
fi
es
the
pa
c
k
et
ei
th
er
as
m
al
w
are
or
as
no
r
m
al
wi
th
ou
t
r
ea
s
s
em
bl
y
.
P
ac
k
et
c
l
as
s
i
fi
ed
as
no
r
m
al
i
s
al
l
o
wed
t
o
pa
s
s
i
n
the
n
et
w
ork
.
Howev
er,
th
e
pa
c
k
et
c
l
as
s
i
fi
ed
as
m
al
war
e
i
s
na
m
ed
c
r
i
ti
c
al
p
ac
k
et
an
d
w
i
l
l
be
s
en
t
to
t
he
s
l
o
w
pa
t
h
f
or
further
an
al
y
s
i
s
i
f
i
t
i
s
tr
an
s
m
i
s
s
i
on
c
on
tr
o
l
protoc
ol
(
T
CP
)
or
droppe
d
i
n
t
he
m
i
dd
l
e
pa
t
h
w
i
tho
ut
be
i
ng
s
en
t
to
t
he
s
l
o
w
p
a
th
i
f
i
t
i
s
us
er
da
ta
gram
protoc
ol
(
UDP)
.
T
he
s
l
ow
pa
th
r
ep
r
es
en
ts
the
s
y
s
t
em
tha
t
c
an
r
ea
s
s
em
bl
e
the
p
ac
k
ets
w
hi
c
h
be
l
o
ng
t
o t
he
s
am
e fl
ow
.
T
o
ex
am
the
prop
os
ed
tec
hn
i
qu
e,
f
or
ex
am
pl
e,
as
s
um
ed
tha
t
o
ne
of
th
e
m
eta
m
orphi
c
fi
l
e
i
s
tr
an
s
f
err
ed
ov
er
the
I
nte
r
ne
t
af
ter
pa
c
k
eti
z
i
ng
t
h
e
fi
l
e
to
5
pa
c
k
ets
of
l
es
s
tha
n
15
0
0
b
y
t
es
.
A
s
s
um
i
ng
the
wor
s
t
c
as
e
s
c
en
ario
,
w
he
r
e
f
ou
r
of
the
s
e
p
ac
k
ets
are
c
l
as
s
i
fi
e
d
as
n
orm
al
be
c
au
s
e
th
e
y
do
n
ot
c
on
tai
n
e
no
u
gh
m
al
w
ar
e
f
ea
tures
.
O
nl
y
on
e
pa
c
k
et
i
s
c
l
as
s
i
fi
ed
as
m
al
w
are.
If
the
de
tec
te
d
p
ac
k
et
i
s
no
t
the
fi
r
s
t
pa
c
k
et
i
n
tha
t
fl
o
w
the
n
i
t
i
s
ne
c
es
s
ar
y
t
o
r
es
t
the
c
on
ne
c
t
i
on
i
n
order
to
al
l
o
w
t
he
s
e
nd
er
s
o
urc
e
to
r
es
en
d
t
he
pa
c
k
ets
of
tha
t
fl
o
w
.
T
he
n
i
t
c
an
c
atc
h
al
l
t
he
s
e
pa
c
k
ets
an
d
s
en
d
th
em
to
the
s
l
o
w
pa
t
h
f
or
m
ore
an
al
y
s
i
s
.
F
i
na
l
l
y
,
th
i
s
fl
o
w
i
s
de
tec
ted
as
m
al
w
are
an
d
dro
pp
e
d
b
y
the
s
l
o
w
p
at
h.
F
i
gu
r
e
1
s
h
o
w
s
t
he
m
ec
ha
ni
s
m
w
h
en
on
l
y
on
e
p
ac
k
et
tha
t
be
l
o
ng
s
to
th
e
fl
o
w
i
s
de
t
ec
ted
as
m
al
w
ar
e
p
ac
k
et.
S
i
m
ul
tan
eo
us
l
y
,
the
c
on
n
ec
ti
o
n
i
s
r
es
et,
an
d
the
c
on
tr
o
l
bi
t
i
s
s
et
i
n
th
e
l
oo
k
up
tab
l
e
w
h
i
c
h
i
s
i
nc
l
ud
ed
i
n
the
I
P
S
Chi
p
i
n
ord
er
to
k
ee
p
the
5
-
tap
l
e
an
d
t
he
s
eq
u
en
c
e
n
um
be
r
of
the
de
tec
te
d
pa
c
k
et
the
n
c
an
be
us
ed
to
c
ap
t
ure
th
e
r
es
en
t
pa
c
k
ets
w
hi
c
h
h
av
e
the
s
a
m
e
5
-
tap
l
e
i
n
ord
er
to
be
s
en
t
to
t
he
s
l
o
w
pa
th
f
or r
ea
s
s
em
bl
e t
h
e fl
o
w
of
th
es
e p
ac
k
ets
.
Evaluation Warning : The document was created with Spire.PDF for Python.
T
E
L
KO
M
NIK
A
IS
S
N: 1
69
3
-
6
93
0
P
r
e
-
fi
l
ters
i
n
-
tr
an
s
i
t
ma
l
war
e p
ac
k
ets
d
ete
c
ti
on
i
n t
he
n
etwo
r
k
...(
B
an
Mo
h
am
m
ed
K
ha
mm
as
)
1709
F
i
gu
r
e
1.
M
ec
ha
ni
s
m
of
m
a
l
w
are
pa
c
k
et
de
tec
te
d i
n t
h
e n
et
wor
k
4.
Dat
a
Co
lle
ctio
n
T
w
o
t
y
p
es
of
da
tas
ets
a
r
e
us
ed
i
n
t
hi
s
arti
c
l
e.
T
he
fi
r
s
t
t
y
pe
i
s
a
m
eta
m
orphi
c
ex
ec
uta
b
l
e
fi
l
es
,
s
ec
on
d
i
s
r
ea
l
tr
af
fi
c
tr
ac
es
,
w
hi
c
h
are
c
ap
ture
d
f
r
o
m
U
T
M
c
am
pu
s
.
In
thi
s
s
tud
y
W
i
nd
ow
1
0
an
d
al
s
o
L
i
n
ux
Ubu
ntu
14
.
0
4
op
erati
ng
s
y
s
t
em
ha
s
be
e
n
us
ed
.
1)
Me
tam
o
r
ph
i
c
Ma
l
war
e:
T
he
m
eta
m
orphi
c
fi
l
es
a
r
e
c
ol
l
ec
t
ed
f
r
om
tw
o
di
f
ferent
s
ou
r
c
es
.
T
he
fi
r
s
t
group
of
fi
l
es
c
on
tai
n
ed
10
9
fi
l
es
f
r
o
m
[
4
]
.
O
u
t
of
the
s
e
10
9
fi
l
es
,
50
fi
l
es
are
f
r
o
m
Nex
t
G
en
erat
i
on
V
i
r
us
C
on
s
tr
uc
t
i
on
K
i
t
(
NG
V
CK
)
,
50
fi
l
es
f
r
om
S
ec
on
d
G
en
erat
i
o
n
(
G
2)
v
i
r
us
,
a
nd
9
fi
l
es
f
r
o
m
Ma
s
s
P
r
od
uc
ed
Code
G
en
er
ati
on
K
i
t
(
M
P
C
G
E
N)
v
i
r
us
.
T
he
s
ec
o
nd
group
en
c
l
os
ed
to
91
1
fi
l
es
whi
c
h
ar
e
ge
ne
r
ate
d
us
i
ng
NG
V
C
K
k
i
t
[
36
]
a
nd
V
X
H
ea
v
en
s
web
s
i
te
a
nd
us
ed
the
s
am
e c
on
fi
gu
r
ati
on
s
et
ti
ng
w
h
ere th
e t
ota
l
nu
m
be
r
of
m
eta
m
orphi
c
fi
l
es
i
s
10
2
0.
2)
UT
M
tr
a
f
f
i
c
tr
ac
es
:
S
i
nc
e
the
prop
os
ed
m
eth
od
ne
ed
as
m
uc
h
as
po
s
s
i
bl
e
m
al
w
ar
e
pa
c
k
ets
the
r
ef
ore,
th
e
c
a
ptu
r
ed
tr
af
fi
c
tr
ac
es
are
o
bta
i
ne
d
f
r
o
m
the
ac
a
de
m
i
c
ne
t
w
ork
an
d
s
tud
en
t
ne
t
wor
k
an
d
i
t
c
ap
t
ured
f
or
on
e
w
e
ek
.
T
he
c
ap
tured
tr
af
fi
c
c
on
t
ai
ne
d
bo
t
h
the
i
nc
om
i
ng
an
d
ou
t
-
go
i
ng
i
nf
or
m
ati
on
f
r
o
m
the
ne
t
w
ork
ga
te
w
a
y
.
T
he
c
ap
tured
tr
ac
es
are
proc
es
s
ed
b
y
m
i
r
r
orin
g
th
e
tr
af
fi
c
to
s
erv
ers
i
n
UT
M
Cent
r
e
f
or
Inf
o
r
m
ati
on
a
nd
Com
m
un
i
c
ati
o
n
T
ec
hn
ol
o
g
y
(
CICT
)
an
d
F
ac
ul
t
y
of
E
l
ec
tr
i
c
al
E
ng
i
n
ee
r
i
n
g
(
F
K
E
)
.
T
he
tr
af
fi
c
tr
ac
es
are
c
ap
ture
d
us
i
ng
T
CP
du
m
p
on
a
L
i
nu
x
s
er
v
er
an
d
l
o
gg
e
d
i
n
p
ac
k
et
c
ap
ture
(
pc
ap
)
.
C
urr
en
t
arti
c
l
e
f
oc
us
ed
o
n
the
T
CP
an
d
UDP
traf
fi
c
on
l
y
be
c
a
us
e m
os
t
m
al
war
e u
s
ed
th
es
e p
r
ot
oc
ol
s
es
pe
c
i
al
l
y
wor
m
[
37
]
.
F
or
ex
tr
ac
ti
n
g
t
he
m
al
w
are
pa
c
k
ets
,
S
no
r
t
was
us
e
d
t
o
tr
i
g
ge
r
t
he
c
a
ptu
r
e
d
of
S
no
r
t
al
ert
a
nd
al
l
the
b
ad
traf
fi
c
.
5.
E
xper
i
men
t
al
R
es
u
lt
s
a
n
d
A
n
a
l
y
si
s
T
he
r
es
ul
ts
of
the
ex
pe
r
e
m
en
ts
c
on
tai
n
t
w
o
pa
r
t.
F
i
r
s
t
pa
r
t,
a
c
om
pa
r
i
s
on
be
twee
n
fl
ow
-
l
ev
el
an
d
pa
c
k
et
-
l
ev
el
m
al
w
are
d
ete
c
t
i
on
i
s
m
ad
e.
S
ec
on
d
p
art,
th
e
r
es
ul
ts
of
the
pro
po
s
e
d
pa
c
k
et
-
l
ev
e
l
m
al
w
ar
e
de
t
e
c
ti
on
are
c
om
pa
r
ed
w
i
th
th
at
of
[
12
,
13
]
to
m
ea
s
ure
the
s
pe
e
du
p
of
the
prop
os
ed
tec
h
ni
qu
e
a
s
c
o
m
pa
r
ed
to
the
c
as
e
when
a
l
l
p
a
c
k
ets
are
s
ub
j
ec
ted
to
ML
c
l
as
s
i
fi
c
ati
on
.
In
thi
s
r
es
e
arc
h,
s
ev
era
l
too
l
s
are
us
ed
.
T
he
s
e
i
nc
l
ud
e
T
CP
DUMP
,
W
E
K
A
,
W
i
r
es
ha
r
k
, IDA
-
P
r
o,
S
no
r
t,
an
d
MA
T
LA
B
.
5.1.
T
h
e
Co
mp
ar
ison
Bet
w
ee
n
F
ow
-
L
ev
el
a
n
d
P
ac
ke
t
-
L
ev
el
M
al
w
ar
e De
t
ec
t
i
o
n
T
hi
s
s
ec
ti
on
c
o
nta
i
ns
ex
pe
r
i
m
en
ts
of
the
r
ea
l
tr
af
fi
c
tr
ac
es
c
ap
ture
d
f
r
om
UT
M
c
am
pu
s
i
n
ord
er
to
tes
t
th
e
a
bi
l
i
t
y
o
f
the
prop
os
ed
t
ec
hn
i
qu
e
(
us
i
ng
on
e
-
week
r
ea
l
tr
af
f
i
c
,
on
e
da
y
us
e
d
as
tr
ai
n
i
ng
a
nd
t
he
r
es
t
da
y
s
us
ed
as
tes
ti
n
g)
whe
n
m
e
tam
orphi
c
are
i
nj
ec
ted
or
wi
tho
ut
i
nj
ec
te
d
the
m
i
n
the
s
e
tr
aff
i
c
tr
ac
e
s
f
or
f
l
ow
an
d
pa
c
k
et
l
ev
el
.
Me
t
am
orphi
c
m
al
war
e
are
i
nj
ec
ted
i
n
the
att
ac
k
da
tas
et
f
or
f
urther
v
al
i
da
te
the
r
es
u
l
ts
as
s
ho
w
n
i
n
F
i
gu
r
e
s
2
an
d
3,
w
he
r
e
(
W
-
W
)
m
ea
ns
w
i
th
m
eta
m
orphi
c
pa
c
k
ets
i
nj
ec
ted
i
n
tr
ai
ni
n
g
an
d
tes
ti
ng
d
ata
s
et
,
(
W
O
-
W
O
)
m
ea
ns
wi
th
ou
t m
eta
m
orphi
c
pa
c
k
e
ts
i
nj
ec
ted
i
n
tr
ai
ni
n
g a
nd
t
e
s
ti
ng
da
tas
e
t.
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N: 16
93
-
6
93
0
T
E
L
KO
M
NIK
A
V
ol
.
17
,
No
.
4
,
A
ug
us
t
20
19
:
1
70
6
-
1
7
14
1710
(
a)
(
b)
(
c
)
F
i
gu
r
e
2.
C
om
pa
r
i
ng
th
e fl
o
w
-
l
ev
el
an
d p
ac
k
et
-
l
e
v
el
de
tec
ti
o
n c
ap
ac
i
t
y
wi
t
h a
nd
wi
tho
ut
m
eta
m
orphi
c
pa
c
k
ets
f
or da
y
1
, d
a
y
2,
a
nd
da
y
3
of
UT
M d
ata
s
et
.
(
a)
Da
y
1 t
r
a
i
n
i
ng
an
d
da
y
2 t
es
ti
ng
,
(
b)
Da
y
2 t
r
a
i
n
i
n
g
an
d
da
y
3
tes
ti
ng
,
(
c
)
Da
y
3 t
r
a
i
n
i
n
g a
n
d d
a
y
4 t
es
ti
ng
5.2.
Co
mp
ar
e
w
it
h
ot
h
er
W
o
r
ks
T
he
r
es
ul
ts
ob
ta
i
n
ed
us
i
ng
the
pro
po
s
ed
m
al
w
are
de
t
ec
ti
on
tec
hn
i
q
ue
f
or
UT
M
da
tas
et
i
s
c
o
m
pa
r
ed
wi
th
[
12
,
13
]
af
ter
r
ep
ea
ti
ng
th
ei
r
m
eth
od
.
T
hi
s
v
al
i
da
tes
th
e
s
pe
ed
u
p
o
f
the
prop
os
ed
tec
hn
i
qu
e
as
w
e
l
l
as
the
pe
r
c
en
t
ag
e
of
the
m
al
w
are
an
d
no
r
m
al
pa
c
k
ets
tha
t
are
s
en
t
to
t
he
n
et
w
ork
or
to
th
e
s
l
o
w
p
ath
.
F
i
g
ure
4
c
l
ea
r
l
y
de
m
on
s
tr
ate
s
tha
t
the
a
v
erage
m
al
w
are
pa
c
k
ets
w
hi
c
h
are
d
ete
c
te
d
i
n
th
e
m
i
dd
l
e
pa
t
h
c
orr
ec
tl
y
wi
th
ou
t
s
en
di
n
g
the
m
to
the
s
l
o
w
p
ath
are
m
ore
tha
n
9
7%.
H
o
w
e
v
er,
w
he
n
[
12
,
13
]
tec
h
ni
qu
e
i
s
us
ed
aroun
d
9
8%
of
m
al
war
e
pa
c
k
ets
ne
ed
t
o
be
s
en
t
to
t
he
s
l
o
w
p
ath
to
m
a
k
e
the
r
ea
s
s
em
bl
y
proc
es
s
i
n
th
e
pa
c
k
ets
f
or
att
ai
n
i
ng
the
fl
o
w
of
the
s
e
p
ac
k
ets
.
In
un
i
on
,
us
i
ng
t
he
pr
op
os
e
d
tec
hn
i
q
ue
m
ore
tha
n
98
%
of
the
n
orm
al
Evaluation Warning : The document was created with Spire.PDF for Python.
T
E
L
KO
M
NIK
A
IS
S
N: 1
69
3
-
6
93
0
P
r
e
-
fi
l
ters
i
n
-
tr
an
s
i
t
ma
l
war
e p
ac
k
ets
d
ete
c
ti
on
i
n t
he
n
etwo
r
k
...(
B
an
Mo
h
am
m
ed
K
ha
mm
as
)
1711
pa
c
k
ets
are
s
en
t
to
t
he
ne
twork
as
c
o
m
pa
r
ed
to
on
l
y
30
%
us
i
n
g
[
12
,
13
]
tec
h
ni
qu
e.
F
i
g
ure
4
s
ho
w
s
th
e
c
om
pa
r
i
s
on
be
t
ween
th
e
pro
po
s
e
d
tec
hn
i
qu
e
an
d
[
12
,
13
]
tec
h
ni
qu
e
f
or
the
UT
M
da
tas
et
.
Mo
r
e
de
t
ai
l
s
ab
o
ut
the
nu
m
be
r
of
pa
c
k
ets
tha
t
are
s
en
t
to
s
l
o
w
pa
t
h
ac
c
ordi
ng
to
the
pro
po
s
ed
t
ec
hn
i
qu
e
i
s
de
p
i
c
ted
i
n
T
ab
l
e
1.
F
r
om
thi
s
ta
bl
e
i
t
i
s
c
l
ea
r
th
at
on
l
y
aroun
d
2%
pa
c
k
ets
on
an
av
era
ge
are
r
eq
ui
r
e
d
to
s
en
d
t
o
the
s
l
o
w
p
ath
.
F
i
gu
r
e
5
s
ho
w
s
th
a
t
the
prop
os
ed
tec
hn
i
qu
e
s
en
t
on
l
y
2%
of
the
tot
a
l
m
al
w
are
a
nd
no
r
m
al
pa
c
k
ets
to
the
s
l
o
w
pa
th
as
c
o
m
pa
r
ed
to
70
%
of
no
r
m
al
an
d
98
%
of
m
a
l
w
are
us
i
ng
[
12
,
13
]
tec
hn
i
qu
e.
T
hi
s
m
ea
ns
tha
t
the
propos
ed
tec
hn
i
qu
e
i
s
aroun
d
37
t
i
m
es
f
as
ter
tha
n
the
ex
i
s
t
i
ng
t
ec
hn
i
qu
e
b
ec
au
s
e
of
the
n
o
ne
e
d
to
s
en
d
s
ev
era
l
no
r
m
al
pa
c
k
ets
to
the
s
l
o
w
pa
th.
It
i
s
b
ec
a
us
e
the
m
i
dd
l
e
p
ath
c
a
n
de
tec
t
m
os
t
o
f
the
m
al
war
e p
ac
k
ets
an
d s
i
m
ul
tan
eo
us
l
y
c
a
n fi
l
ter s
e
v
eral
n
orm
al
pa
c
k
ets
.
(
a)
(
b)
(
c
)
F
i
gu
r
e
3.
C
om
pa
r
i
ng
th
e fl
o
w
-
l
ev
el
an
d p
ac
k
et
-
l
e
v
el
de
tec
ti
o
n c
ap
ac
i
t
y
wi
t
h a
nd
wi
tho
ut
m
eta
m
orphi
c
pa
c
k
ets
f
or da
y
4,
d
a
y
5,
a
nd
da
y
6
of
UT
M d
ata
s
et
.
(
a)
Da
y
4 t
r
a
i
n
i
ng
an
d
da
y
5 t
es
ti
ng
,
(
b)
Da
y
5 t
r
a
i
n
i
n
g
an
d
da
y
6
tes
ti
ng
,
(
c
)
Da
y
6 t
r
a
i
n
i
n
g
an
d d
a
y
7
te
s
ti
n
g
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N: 16
93
-
6
93
0
T
E
L
KO
M
NIK
A
V
ol
.
17
,
No
.
4
,
A
ug
us
t
20
19
:
1
70
6
-
1
7
14
1712
T
ab
l
e 1
. T
he
d
eta
i
l
s
of
T
CP
P
ac
k
ets
T
ha
t Cl
as
s
i
fi
ed
I
n
Mi
d
dl
e P
ath
f
or UT
M
T
r
a
f
fi
c
T
r
ac
es
D
a
y
Total
malw
a
r
e
p
a
c
k
e
t
s
N
o
.
o
f
m
a
lw
a
r
e
TC
P
p
a
c
k
e
t
s
N
o
.
o
f
m
a
lw
a
r
e
U
D
P
p
a
c
k
e
t
s
TC
P
n
o
r
m
a
l
p
a
c
k
e
t
s
%
M
a
lw
a
r
e
d
e
t
e
c
t
e
d
b
y
mi
d
d
le
p
a
t
h
%
TC
P
p
a
c
k
e
t
s
s
e
n
t
t
o
s
low
p
a
t
h
2
8
,
8
8
3
0
8
,
8
8
3
1
3
,
5
6
0
9
6
.
7
8
%
0
.
5
6
%
3
9
,
3
0
8
38
9
,
2
7
0
1
7
,
3
8
0
9
3
.
5
8
%
0
.
8
8
%
4
5
,
8
7
2
9
5
,
8
6
3
1
5
,
0
7
6
9
7
.
8
3
%
2
.
0
7
%
5
1
0
,
2
0
6
6
1
0
,
2
0
0
2
0
,
9
3
2
9
8
.
3
2
%
2
.
2
0
%
6
8
,
4
4
9
22
8
,
4
2
7
1
7
,
0
3
2
9
8
.
5
3
%
2
.
3
8
%
7
5
,
9
7
3
11
5
,
9
6
2
7
,
7
6
7
9
8
.
5
9
%
5
.
4
1
%
F
i
gu
r
e
4.
P
erc
en
t
ag
e
of
al
l
6 d
a
y
s
UT
M d
at
as
et
th
at
ar
e s
en
t t
o s
l
o
w pa
th,
where
P
T
: p
r
op
os
ed
tec
hn
i
qu
e
, S
P
: s
l
o
w
p
ath
,
V
T
:
[
12
,
13
]
tec
hn
i
qu
e,
n
: n
or
m
al
, a
nd
m
:
m
al
w
are
(
a)
(
b)
F
i
gu
r
e
5.
R
es
ul
t c
om
pa
r
i
s
o
n b
et
wee
n t
h
e p
r
o
po
s
ed
te
c
hn
i
q
ue
a
nd
[
12
,
13
]
t
ec
hn
i
qu
e
(
a). P
r
op
os
ed
t
ec
hn
i
qu
e re
s
ul
t
,
(
b).
V
arg
he
s
e e
t a
l
.
[
12
]
tec
h
ni
q
ue
r
es
u
l
t
Evaluation Warning : The document was created with Spire.PDF for Python.
T
E
L
KO
M
NIK
A
IS
S
N: 1
69
3
-
6
93
0
P
r
e
-
fi
l
ters
i
n
-
tr
an
s
i
t
ma
l
war
e p
ac
k
ets
d
ete
c
ti
on
i
n t
he
n
etwo
r
k
...(
B
an
Mo
h
am
m
ed
K
ha
mm
as
)
1713
6
. Con
clus
ion
T
he
propos
ed
m
i
dd
l
e
pa
t
h
pre
-
fi
l
ters
i
n
-
tr
a
ns
i
t
p
ac
k
ets
to
m
i
ni
m
i
z
e
th
e
nu
m
be
r
of
pa
c
k
ets
s
en
t
to
the
s
l
o
w
pa
th,
w
he
r
e
pa
c
k
ets
are
r
ea
s
s
em
bl
ed
an
d
are
s
u
bj
ec
ted
to
f
ul
l
m
al
w
are
d
ete
c
ti
on
.
T
hi
s
pr
op
os
ed
tec
hn
i
q
ue
c
an
s
p
e
ed
up
the
tr
an
s
m
i
s
s
i
on
of
s
ev
era
l
no
r
m
al
pa
c
k
ets
w
i
tho
ut
s
en
d
i
ng
th
em
to
the
s
l
o
w
pa
th
l
i
k
e
oth
er
m
eth
od
.
It
i
s
v
er
i
fi
ed
th
at
the
prop
os
ed
tec
hn
i
qu
e
c
an
proc
es
s
the
no
r
m
al
pa
c
k
ets
m
uc
h
f
as
t
er
tha
n
V
arg
he
s
e
et
a
l
.
tec
hn
i
qu
e
d
ue
to
the
no
n
-
r
e
qu
i
r
em
en
t
of
s
en
d
i
ng
m
an
y
n
orm
al
pa
c
k
ets
to
s
l
o
w
pa
t
h
t
ha
t
n
ee
d
ti
m
e
f
or
r
ea
s
s
em
bl
i
ng
an
d
c
h
ec
k
i
ng
the
s
e
pa
c
k
ets
.
O
nl
y
v
er
y
f
e
w
n
um
be
r
of
the
tot
a
l
m
al
war
e
an
d
no
r
m
al
pa
c
k
ets
are
s
en
t
to
the
s
l
o
w
pa
th
f
or
f
urther
an
al
y
s
i
s
.
W
hi
l
e
s
ti
l
e
c
an
d
ete
c
t
s
ev
eral
ne
w
m
al
w
are
an
d
s
om
e o
f
m
eta
m
orphi
c
m
al
war
e m
ore tha
n h
a
l
f
of
th
em
c
an
be
de
t
ec
ted
c
orr
ec
tl
y
.
It
i
s
af
fi
r
m
ed
tha
t
the
d
ev
el
op
ed
m
eth
od
i
s
s
ui
tab
l
e
f
or
de
t
ec
ti
n
g
fi
x
ed
an
d
s
o
m
e
of
m
uta
ted
m
al
w
are
i
n t
he
ne
t
wor
k
l
ev
el
b
ef
ore i
t
r
ea
c
h
the
ho
s
t.
T
he
hi
gh
er fl
ex
i
b
i
l
i
t
y
of
th
e
pres
en
t m
eth
od
al
l
o
w
s
bu
i
l
di
ng
t
he
d
ete
c
t
i
o
n
i
n
ne
t
wor
k
l
a
y
er
af
ter
tr
ai
ni
n
g
th
e
m
od
el
on
the
m
al
war
e
pa
c
k
ets
i
n
the
m
i
dd
l
e
-
b
ox
es
or
i
n
fl
o
w
-
l
e
v
e
l
at
th
e
ho
s
t
l
e
v
e
l
on
th
e
w
h
ol
e
fl
o
w
of
m
al
w
are
af
ter
r
ea
s
s
em
bl
i
ng
the
pa
c
k
ets
fl
o
w
.
It
i
s
es
tab
l
i
s
he
d
th
at
th
e
propos
ed
m
eth
od
c
an
protec
t
ne
t
wor
k
s
f
r
o
m
the
s
pread
of
s
om
e
t
y
p
es
of
m
al
w
are
f
r
om
the
i
r
pa
y
l
oa
d.
F
or
th
e
f
utu
r
e
wor
k
s
,
the
propos
e
d
t
ec
hn
i
qu
e
c
an
be
i
m
pl
em
en
ted
i
n
ha
r
d
w
are
d
ev
i
c
es
f
or
r
ea
l
t
i
m
e
tr
af
fi
c
c
l
as
s
i
fi
c
ati
on
i
n
FPG
A
.
Ref
er
en
ce
s
[1
]
Sy
m
a
n
te
c
,
Sy
m
a
n
te
c
R
e
p
o
rt
.
h
tt
p
s
:/
/w
ww
.s
y
m
a
n
te
c
.
c
o
m
/p
r
o
d
u
c
t
s
/t
h
r
e
a
t
-
p
r
o
te
c
ti
o
n
.
2
0
1
6
.
[2
]
Bo
u
k
h
t
o
u
t
a
A,
e
t
a
l
.,
Ne
tw
o
rk
m
a
l
w
a
re
c
l
a
s
s
i
f
i
c
a
ti
o
n
c
o
m
p
a
r
i
s
o
n
u
s
i
n
g
DPI
a
n
d
fl
o
w
p
a
c
k
e
t
h
e
a
d
e
rs
.
J
o
u
rn
a
l
o
f
Com
p
u
te
r
Vi
ro
l
o
g
y
a
n
d
Ha
c
k
i
n
g
T
e
c
h
n
i
q
u
e
s
.
2
0
1
6
;
1
2
(2
):
6
9
-
100.
[3
]
O
z
a
A,
e
t
a
l
.
HT
T
P
a
tt
a
c
k
d
e
te
c
ti
o
n
u
s
i
n
g
n
-
g
ra
m
a
n
a
l
y
s
i
s
.
Com
p
u
te
r
s
&
Se
c
u
ri
t
y
.
2
0
1
4
;
4
5
:
2
4
2
-
2
5
4
.
[4
]
Des
h
p
a
n
d
e
S,
Y
Pa
rk
,
M
Sta
m
p
.
Ei
g
e
n
v
a
l
u
e
a
n
a
l
y
s
i
s
fo
r
m
e
ta
m
o
rp
h
i
c
d
e
t
e
c
t
i
o
n
.
J
o
u
rn
a
l
o
f
Com
p
u
te
r Vi
ro
l
o
g
y
a
n
d
Ha
c
k
i
n
g
T
e
c
h
n
i
q
u
e
s
.
2
0
1
4
;
1
0
(1
)
:
5
3
-
65.
[5
]
Att
a
l
u
r
i
S
,
S
M
c
G
h
e
e
,
M
Sta
m
p
.
Pro
f
i
l
e
h
i
d
d
e
n
M
a
rk
o
v
m
o
d
e
l
s
a
n
d
m
e
ta
m
o
r
p
h
i
c
v
i
ru
s
d
e
te
c
t
i
o
n
.
J
o
u
rn
a
l
i
n
c
o
m
p
u
te
r
v
i
r
o
l
o
g
y
.
2
0
0
9
;
5
(
2
):
1
5
1
-
1
6
9
.
[6
]
Can
fo
ra
G
,
AN
I
a
n
n
a
c
c
o
n
e
,
C
A
Vi
s
a
g
g
i
o
.
Sta
t
i
c
a
n
a
l
y
s
i
s
fo
r
th
e
d
e
te
c
ti
o
n
o
f
m
e
t
a
m
o
r
p
h
i
c
c
o
m
p
u
te
r
v
i
ru
s
e
s
u
s
i
n
g
re
p
e
a
te
d
-
i
n
s
tr
u
c
ti
o
n
s
c
o
u
n
ti
n
g
h
e
u
ri
s
ti
c
s
.
J
o
u
r
n
a
l
o
f
Com
p
u
te
r
Vi
ro
l
o
g
y
a
n
d
Hac
k
i
n
g
Te
c
h
n
i
q
u
e
s
.
2
0
1
4
;
1
0
(1
):
1
1
-
2
7
.
[7
]
So
n
g
F
,
T
T
o
u
i
l
i
.
Eff
i
c
i
e
n
t
m
a
l
ware
d
e
t
e
c
t
i
o
n
u
s
i
n
g
m
o
d
e
l
-
c
h
e
c
k
i
n
g
.
i
n
In
te
rn
a
ti
o
n
a
l
Sy
m
p
o
s
i
u
m
o
n
Fo
rm
a
l
M
e
th
o
d
s
.
S
p
ri
n
g
e
r
.
20
12
.
[8
]
M
o
h
a
m
m
e
d
M
,
A
L
a
k
h
o
ti
a
.
A
m
e
th
o
d
to
d
e
t
e
c
t
m
e
t
a
m
o
r
p
h
i
c
c
o
m
p
u
te
r
v
i
ru
s
e
s
.
Th
e
IEEE
Com
p
u
te
r
So
c
i
e
ty
’
s
St
u
d
e
n
t
M
a
g
a
z
i
n
e
.
2003
;
1
0
(1
):
2
4
-
3
6
.
[9
]
Kh
a
m
m
a
s
B
M
,
e
t
a
l
.
M
e
ta
m
o
rp
h
i
c
M
a
l
w
a
re
Det
e
c
ti
o
n
Ba
s
e
d
o
n
Su
p
p
o
rt
Ve
c
to
r
M
a
c
h
i
n
e
Cla
s
s
i
fi
c
a
t
i
o
n
o
f
M
a
l
w
a
re
Su
b
-
Si
g
n
a
t
u
re
s
.
TEL
KO
M
NIKA
Te
l
e
c
o
m
m
u
n
i
c
a
ti
o
n
Com
p
u
ti
n
g
E
l
e
c
tr
o
n
i
c
s
a
n
d
Co
n
tro
l
.
2
0
1
6
;
1
4
(3
):
1
1
5
7
-
1165.
[1
0
]
Y
e
n
T
-
F
,
M
K
Rei
te
r.
Tra
ff
i
c
a
g
g
r
e
g
a
t
i
o
n
fo
r
m
a
l
ware
d
e
te
c
ti
o
n
.
i
n
In
t
e
rn
a
t
i
o
n
a
l
Co
n
f
e
re
n
c
e
o
n
Det
e
c
t
i
o
n
o
f
In
tru
s
i
o
n
s
a
n
d
M
a
l
w
a
re
,
a
n
d
Vu
l
n
e
r
a
b
i
l
i
ty
As
s
e
s
s
m
e
n
t.
2
0
0
8
.
[1
1
]
M
i
s
ra
A,
M
Ve
rm
a
,
A
Sh
a
r
m
a
.
Cap
tu
r
i
n
g
t
h
e
i
n
te
rp
l
a
y
b
e
twe
e
n
m
a
l
ware
a
n
d
a
n
ti
-
m
a
l
ware
i
n
a
c
o
m
p
u
te
r
n
e
two
r
k
.
Ap
p
l
i
e
d
M
a
th
e
m
a
ti
c
s
a
n
d
Co
m
p
u
ta
ti
o
n
.
2
0
1
4
;
2
2
9
:
3
4
0
-
349.
[1
2
]
Va
rg
h
e
s
e
G
,
J
A
Fi
n
g
e
rh
u
t,
F
Bo
n
o
m
i
.
Det
e
c
t
i
n
g
e
v
a
s
i
o
n
a
tt
a
c
k
s
a
t
h
i
g
h
s
p
e
e
d
s
w
i
th
o
u
t
r
e
a
s
s
e
m
b
l
y
.
in
ACM
SI
G
CO
M
M
Co
m
p
u
te
r
Com
m
u
n
i
c
a
ti
o
n
Re
v
i
e
w
.
2
0
0
6
;
3
6
(4
):
3
2
7
-
3
3
8
.
[1
3
]
Va
rg
h
e
s
e
G
,
FG
Bo
n
o
m
i
,
J
A
Fi
n
g
e
r
h
u
t
.
M
e
th
o
d
s
a
n
d
s
y
s
te
m
s
to
d
e
te
c
t
a
n
e
v
a
s
i
o
n
a
tt
a
c
k
.
G
o
o
g
l
e
Pa
te
n
t
s
.
2
0
1
3
.
[1
4
]
Che
n
Z,
e
t
a
l
.
M
a
c
h
i
n
e
l
e
a
r
n
i
n
g
b
a
s
e
d
m
o
b
i
l
e
m
a
l
w
a
re
d
e
t
e
c
ti
o
n
u
s
i
n
g
h
i
g
h
l
y
i
m
b
a
l
a
n
c
e
d
n
e
tw
o
r
k
tra
ff
i
c
.
In
fo
rm
a
ti
o
n
Sc
i
e
n
c
e
s
.
2
0
1
8
;
4
3
3
:
3
4
6
-
364.
[1
5
]
T
a
y
l
o
r
T
P,
e
t
a
l
.
M
e
th
o
d
s
,
s
y
s
te
m
s
,
a
n
d
c
o
m
p
u
te
r
r
e
a
d
a
b
l
e
m
e
d
i
a
fo
r
d
e
te
c
ti
n
g
m
a
l
i
c
i
o
u
s
n
e
tw
o
r
k
tra
ff
i
c
.
G
o
o
g
l
e
Pa
te
n
t
s
.
2
0
1
8
.
[1
6
]
W
a
n
g
S,
e
t
a
l
.
A
m
o
b
i
l
e
m
a
l
w
a
re
d
e
t
e
c
t
i
o
n
m
e
th
o
d
u
s
i
n
g
b
e
h
a
v
i
o
r
fe
a
tu
re
s
i
n
n
e
tw
o
rk
tra
ff
i
c
.
J
o
u
rn
a
l
o
f
Net
wor
k
a
n
d
Co
m
p
u
te
r
Ap
p
l
i
c
a
ti
o
n
s
.
2019
;
1
3
3
:
1
5
-
25
.
[1
7
]
Ai
j
a
z
UN
,
e
t
a
l
.
M
a
l
w
a
re
Det
e
c
ti
o
n
o
n
Se
rv
e
r
u
s
i
n
g
Dis
tri
b
u
te
d
M
a
c
h
i
n
e
L
e
a
rn
i
n
g
.
Pe
r
s
p
e
c
t
i
v
e
s
i
n
Com
m
u
n
i
c
a
ti
o
n
.
Em
b
e
d
d
e
d
-
s
y
s
te
m
s
a
n
d
Si
g
n
a
l
-
p
r
o
c
e
s
s
i
n
g
-
Pi
CES
,
2
0
1
8
;
2
(7
):
1
7
2
-
1
7
5
.
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N: 16
93
-
6
93
0
T
E
L
KO
M
NIK
A
V
ol
.
17
,
No
.
4
,
A
ug
us
t
20
19
:
1
70
6
-
1
7
14
1714
[1
8
]
W
a
n
g
S,
e
t
a
l
.
De
e
p
a
n
d
Bro
a
d
L
e
a
rn
i
n
g
b
a
s
e
d
Det
e
c
ti
o
n
o
f
An
d
ro
i
d
M
a
l
ware
v
i
a
Net
wor
k
Tra
ff
i
c
.
i
n
2
0
1
8
I
EEE
/ACM
2
6
th
I
n
te
rn
a
ti
o
n
a
l
Sy
m
p
o
s
i
u
m
o
n
Qu
a
l
i
ty
o
f
Se
rv
i
c
e
(I
W
Q
o
S)
.
2
0
1
8
.
[1
9
]
M
a
c
h
l
i
c
a
L
,
M
So
fk
a
.
Hie
ra
r
c
h
i
c
a
l
fe
a
tu
re
e
x
tra
c
ti
o
n
fo
r
m
a
l
w
a
re
c
l
a
s
s
i
fi
c
a
ti
o
n
i
n
n
e
t
w
o
rk
tra
ff
i
c
.
G
o
o
g
l
e
P
a
te
n
t
s
.
2019
.
[2
0
]
L
i
u
J
-
X
,
D
-
M
Zh
a
o
,
F
W
a
n
g
.
Net
work
s
Att
a
c
k
-
De
fe
n
s
e
m
o
d
e
l
b
a
s
e
d
o
n
th
e
i
m
p
ro
v
e
d
L
a
n
c
h
e
s
te
r
e
q
u
a
t
i
o
n
.
2
0
1
3
I
n
t
e
rn
a
t
i
o
n
a
l
C
o
n
fe
re
n
c
e
o
n
M
a
c
h
i
n
e
L
e
a
rn
i
n
g
a
n
d
C
y
b
e
r
n
e
ti
c
s
(I
CM
L
C)
.
2
0
1
3
.
[2
1
]
Day
C
.
In
tru
s
i
o
n
Pre
v
e
n
t
i
o
n
a
n
d
Det
e
c
ti
o
n
Sy
s
te
m
s
,
i
n
M
a
n
a
g
i
n
g
In
fo
rm
a
ti
o
n
S
e
c
u
r
i
t
y
(Se
c
o
n
d
Ed
i
ti
o
n
)
.
El
s
e
v
i
e
r
.
2
0
1
4
:
1
1
9
-
1
4
2
.
[2
2
]
d
e
L
i
m
a
IVM
,
J
A
Deg
a
s
p
a
r
i
,
J
BM
So
b
ra
l
.
In
tru
s
i
o
n
d
e
te
c
ti
o
n
th
ro
u
g
h
a
rt
i
fi
c
i
a
l
n
e
u
r
a
l
n
e
two
rk
s
.
i
n
Net
w
o
rk
Ope
ra
ti
o
n
s
a
n
d
M
a
n
a
g
e
m
e
n
t
Sy
m
p
o
s
i
u
m
,
NO
M
S.
2
0
0
8
.
[2
3
]
d
e
Sá
Si
l
v
a
L
,
e
t
a
l
.
Det
e
c
t
i
n
g
a
tt
a
c
k
s
i
g
n
a
tu
re
s
i
n
th
e
re
a
l
n
e
tw
o
rk
tra
ff
i
c
w
i
th
ANN
IDA
.
Ex
p
e
r
t
Sy
s
te
m
s
wi
th
A
p
p
l
i
c
a
ti
o
n
s
.
2
0
0
8
;
3
4
(
4
):
2
3
2
6
-
2
3
3
3
.
[2
4
]
d
e
Sa
Si
l
v
a
L
,
e
t
a
l
.
A n
e
u
r
a
l
n
e
two
rk
a
p
p
l
i
c
a
ti
o
n
fo
r
a
tt
a
c
k
d
e
te
c
t
i
o
n
i
n
c
o
m
p
u
te
r n
e
two
r
k
s
.
i
n
Neu
r
a
l
Net
w
o
rk
s
,
2
0
0
4
.
Pro
c
e
e
d
i
n
g
s
.
2
0
0
4
I
EEE
I
n
te
r
n
a
t
i
o
n
a
l
J
o
i
n
t
Con
fe
re
n
c
e
o
n
.
2
0
0
4
.
[2
5
]
Is
m
a
i
l
I,
e
t
a
l
.
In
c
o
rp
o
r
a
ti
n
g
k
n
o
w
n
m
a
l
w
a
re
s
i
g
n
a
tu
re
s
to
c
l
a
s
s
i
fy
n
e
w
m
a
l
w
a
re
v
a
ri
a
n
ts
i
n
n
e
tw
o
r
k
tra
ff
i
c
.
In
te
rn
a
ti
o
n
a
l
J
o
u
r
n
a
l
o
f
Net
work
M
a
n
a
g
e
m
e
n
t
.
2
0
1
5
;
2
5
(6
):
4
7
1
-
4
8
9
.
[2
6
]
Hij
a
z
i
AA,
Net
w
o
rk
T
ra
ff
i
c
Cha
ra
c
te
ri
z
a
ti
o
n
Us
i
n
g
(p
,
n
)
-
g
ra
m
s
Pa
c
k
e
t
Rep
re
s
e
n
ta
t
i
o
n
.
Carl
e
t
o
n
Uni
v
e
r
s
i
t
y
.
2
0
1
4
.
[2
7
]
Rie
c
k
K
,
P
L
a
s
k
o
v
.
De
te
c
ti
n
g
u
n
k
n
o
wn
n
e
tw
o
rk
a
tt
a
c
k
s
u
s
i
n
g
l
a
n
g
u
a
g
e
m
o
d
e
l
s
.
i
n
I
n
te
rn
a
t
i
o
nal
Con
fe
re
n
c
e
o
n
De
t
e
c
t
i
o
n
o
f
In
t
ru
s
i
o
n
s
a
n
d
M
a
l
w
a
re
,
a
n
d
V
u
l
n
e
ra
b
i
l
i
ty
As
s
e
s
s
m
e
n
t
.
Sp
ri
n
g
e
r
.
2
0
0
6
.
[2
8
]
Ah
m
e
d
I
,
K
-
s
L
h
e
e
.
Cla
s
s
i
fi
c
a
ti
o
n
o
f
p
a
c
k
e
t
c
o
n
te
n
t
s
fo
r
m
a
l
w
a
re
d
e
te
c
ti
o
n
.
J
o
u
rn
a
l
i
n
c
o
m
p
u
te
r
Vi
ro
l
o
g
y
.
2011
;
7
(4
)
:
2
7
9
.
[2
9
]
T
o
rra
n
o
-
G
i
m
e
n
e
z
C,
e
t
a
l
.
Ap
p
l
y
i
n
g
f
e
a
tu
r
e
s
e
l
e
c
ti
o
n
to
p
a
y
l
o
a
d
-
b
a
s
e
d
web
a
p
p
l
i
c
a
ti
o
n
fi
r
e
wal
l
s
.
i
n
Se
c
u
ri
ty
a
n
d
Co
m
m
u
n
i
c
a
t
i
o
n
Net
w
o
rk
s
(I
W
S
CN
),
2
0
1
1
T
h
i
r
d
I
n
te
r
n
a
ti
o
n
a
l
W
o
r
k
s
h
o
p
o
n
.
2
0
1
1
.
[3
0
]
Pe
rd
i
s
c
i
R, e
t
a
l
.
M
c
PAD:
A
m
u
l
ti
p
l
e
c
l
a
s
s
i
fi
e
r s
y
s
te
m
fo
r a
c
c
u
ra
te
p
a
y
l
o
a
d
-
b
a
s
e
d
a
n
o
m
a
l
y
d
e
te
c
ti
o
n
.
Com
p
u
te
r n
e
two
rk
s
.
2
0
0
9
;
5
3
(
6
):
8
6
4
-
8
8
1
.
[3
1
]
So
n
g
Y
,
AD
Ke
ro
m
y
ti
s
,
SJ
Sto
l
fo
.
S
p
e
c
tro
g
ra
m
:
A
M
i
x
tu
re
-
of
-
M
a
rk
o
v
-
Cha
i
n
s
M
o
d
e
l
f
o
r
An
o
m
a
l
y
Det
e
c
t
i
o
n
i
n
We
b
T
r
a
ff
i
c
.
i
n
N
DSS. 2
0
0
9
.
[3
2
]
Pe
k
ta
ş
A
,
T
Ac
a
rm
a
n
.
M
a
l
ware
c
l
a
s
s
i
fi
c
a
t
i
o
n
b
a
s
e
d
o
n
API
c
a
l
l
s
a
n
d
b
e
h
a
v
i
o
u
r
a
n
a
l
y
s
i
s
.
I
E
T
In
fo
rm
a
ti
o
n
Se
c
u
ri
ty
.
2017
;
1
2
(2
):
1
0
7
-
1
1
7
.
[3
3
]
Ko
l
te
r
J
Z
,
M
A
M
a
l
o
o
f
.
L
e
a
rn
i
n
g
to
d
e
te
c
t
a
n
d
c
l
a
s
s
i
fy
m
a
l
i
c
i
o
u
s
e
x
e
c
u
ta
b
l
e
s
i
n
t
h
e
w
i
l
d
.
J
o
u
rn
a
l
o
f
M
a
c
h
i
n
e
L
e
a
rn
i
n
g
Re
s
e
a
r
c
h
.
2
0
0
6
;
7
(D
e
c
):
2
7
2
1
-
2
7
4
4
.
[3
4
]
Kh
a
m
m
a
s
BM
,
e
t
a
l
.
Fe
a
tu
re
s
e
l
e
c
t
i
o
n
a
n
d
m
a
c
h
i
n
e
l
e
a
rn
i
n
g
c
l
a
s
s
i
f
i
c
a
ti
o
n
fo
r
m
a
l
w
a
re
d
e
te
c
ti
o
n
.
J
u
rn
a
l
T
e
k
n
o
l
o
g
i
.
2
0
1
5
;
7
7
(1
)
:
2
4
3
-
2
5
0
.
[3
5
]
Ab
u
Hm
e
d
T
,
A
M
o
h
a
i
s
e
n
,
D
Ny
a
n
g
.
A
s
u
rv
e
y
o
n
d
e
e
p
p
a
c
k
e
t
i
n
s
p
e
c
t
i
o
n
fo
r
i
n
tru
s
i
o
n
d
e
te
c
ti
o
n
s
y
s
te
m
s
.
M
a
g
a
z
i
n
e
o
f
Ko
re
a
T
e
l
e
c
o
m
m
u
n
i
c
a
ti
o
n
So
c
i
e
t
y
.
2
0
0
7
;
2
4
(
1
1
):
2
5
-
3
6
.
[3
6
]
Al
a
m
S,
e
t
a
l
.
A
fra
m
e
w
o
rk
fo
r
m
e
ta
m
o
rp
h
i
c
m
a
l
w
a
re
a
n
a
l
y
s
i
s
a
n
d
re
a
l
-
ti
m
e
d
e
t
e
c
t
i
o
n
.
Co
m
p
u
te
rs
&
Se
c
u
ri
ty
.
2
0
1
5
;
4
8
:
2
1
2
-
2
3
3
.
[3
7
]
L
i
P,
M
Sa
l
o
u
r,
X
Su
.
A
s
u
rv
e
y
o
f
i
n
te
r
n
e
t
worm
d
e
te
c
ti
o
n
a
n
d
c
o
n
t
a
i
n
m
e
n
t.
IEEE
Com
m
u
n
i
c
a
ti
o
n
s
Su
rv
e
y
s
&
T
u
to
ri
a
l
s
.
2
0
0
8
;
1
0
(
1
)
:
2
0
-
35
.
Evaluation Warning : The document was created with Spire.PDF for Python.