I
A
E
S
I
n
t
e
r
n
at
io
n
al
Jou
r
n
al
of
A
r
t
if
ic
ia
l
I
n
t
e
ll
ig
e
n
c
e
(
I
J
-
AI
)
V
ol
. 14, No. 5, O
c
to
be
r
2025
, pp.
3945
~
3957
I
S
S
N
:
2252
-
8938
,
D
O
I
:
10.11591/
ij
a
i.
v
14
.i
5
.pp
3945
-
3957
3945
Jou
r
n
al
h
om
e
page
:
ht
tp
:
//
ij
ai
.
ia
e
s
c
or
e
.c
om
T
w
o
-
st
e
p
s f
e
at
u
r
e
se
l
e
c
t
i
on
f
or
d
e
t
e
c
t
i
on
var
i
an
t
d
i
st
r
i
b
u
t
e
d
d
e
n
i
al
of
se
r
vi
c
e
s
a
t
t
a
c
k
i
n
c
l
ou
d
e
n
vi
r
on
m
e
n
t
K
u
r
n
ia
b
u
d
i
1
,
E
k
o A
r
ip
Wi
n
an
t
o
1,
2
, S
h
ar
ip
u
d
d
in
3
1
D
e
pa
r
t
m
e
nt
of
C
om
put
e
r
E
ngi
ne
e
r
i
ng
, F
a
c
ul
t
y of
C
om
put
e
r
s
S
c
i
e
nc
e
,
U
ni
ve
r
s
i
t
a
s
D
i
na
m
i
ka
B
a
ng
s
a
, J
a
m
bi
, I
ndone
s
i
a
2
F
a
c
ul
t
y
of
C
om
put
i
ng, U
ni
ve
r
s
i
t
i
T
e
knol
ogi
M
a
l
a
ys
i
a
, J
ohor
, M
a
l
a
ys
i
a
3
D
e
pa
r
t
m
e
nt
of
I
nf
or
m
a
t
i
c
, F
a
c
ul
t
y o
f
C
om
put
e
r
s
S
c
i
e
nc
e
,
U
ni
ve
r
s
i
t
a
s
D
i
na
m
i
k
a
B
a
ngs
a
, J
a
m
bi
, I
ndone
s
i
a
A
r
t
ic
le
I
n
f
o
A
B
S
T
R
A
C
T
A
r
ti
c
le
h
is
to
r
y
:
R
e
c
e
iv
e
d
A
ug 13, 2024
R
e
vi
s
e
d
J
un 17, 2025
A
c
c
e
pt
e
d
J
ul
10, 2025
The
prevalence
of
cloud
computing
among
organizations
poses
a
sign
ificant
problem
in
ensuring
security.
Specifically,
distributed
denial
of
s
ervices
(DDoS)
attacks
targeting
cloud
computing
networks
can
lead
to
fi
nancial
losses
for
consumers
of
cloud
computing
services.
This
assault
h
as
the
potential
to
render
cloud
services
inaccessible.
The
detection
system
serves
as
a
remedy
to
prevent
more
substantial
losses.
This
research
ai
ms
to
enhance
the
efficacy
of
the
system
d
etection
model
by
integrat
ing
feature
selection
with
three
machine
learning
algorithms:
decision
tree
(DT),
random
forest
(RF),
and
n
aïve
Bayes
(NB).
Therefore,
our
study
su
ggests
combini
ng
two
phases
of
feature
selection
into
the
DDoS
attack
de
tection
procedure.
The
first
phase
uses
the
information
gain
(IG)
feature
se
lection
technique
approac
h,
and
the
second
phase
uses
the
principal
com
ponent
a
nalysis
(PCA)
feature
extraction
approach.
The
technique
is
referre
d
to
as
two
-
step
feature
selection
.
The
test
findings
indicate
that
the
impleme
ntation
of
two
-
step
feature
selection
can
enhance
the
performance
of
the
DT
a
nd
RF
detection models by around 9
%
.
K
e
y
w
o
r
d
s
:
A
tt
a
c
k de
te
c
ti
on
C
la
s
s
if
ic
a
ti
on
D
D
oS
F
e
a
tu
r
e
s
e
le
c
ti
on
M
a
c
hi
ne
l
e
a
r
ni
ng
This is an
open
acce
ss artic
le unde
r the
CC BY
-
SA
license.
C
or
r
e
s
pon
di
n
g A
u
th
or
:
K
ur
ni
a
budi
D
e
pa
r
tm
e
nt
of
C
om
put
e
r
E
ngi
ne
e
r
in
g, F
a
c
ul
ty
of
C
om
put
e
r
s
S
c
ie
nc
e
,
U
ni
ve
r
s
it
a
s
D
in
a
m
ik
a
B
a
ngs
a
J
e
ndr
a
l
S
udi
r
m
a
n S
tr
e
e
t,
T
he
hok
–
J
a
m
bi
, I
ndone
s
ia
E
m
a
il
:
kbudiz
@
ya
hoo.c
om
1.
I
N
T
R
O
D
U
C
T
I
O
N
C
lo
u
d
c
o
m
pu
ti
ng
ha
s
r
e
v
ol
ut
io
n
iz
e
d
in
f
o
r
m
a
t
io
n
te
c
h
no
lo
gy
a
nd
c
ha
nge
d
th
e
b
us
i
ne
s
s
m
o
de
l
f
o
r
pr
ovi
di
ng
I
T
s
e
r
v
ic
e
s
.
T
h
is
te
c
hn
ol
ogy
a
ll
ow
s
us
e
r
s
to
a
c
c
e
s
s
va
r
io
us
I
T
r
e
s
ou
r
c
e
s
,
s
uc
h
a
s
s
e
r
ve
r
s
,
s
to
r
a
ge
,
a
nd
a
p
pl
ic
a
ti
o
ns
,
t
hr
ou
gh
a
w
e
l
l
-
m
a
na
ge
d
a
nd
s
c
a
la
b
le
ne
t
w
o
r
k
.
A
s
a
d
op
ti
on
be
c
om
e
s
m
o
r
e
w
id
e
s
pr
e
a
d
,
m
a
n
y
o
r
ga
n
iz
a
t
io
ns
le
ve
r
a
ge
c
lo
ud
i
nf
r
a
s
tr
uc
tu
r
e
f
or
th
e
ir
da
ta
m
a
na
ge
m
e
n
t
[
1]
.
H
ow
e
ve
r
,
be
hi
nd
t
he
v
a
r
io
us
a
d
va
n
ta
ge
s
p
r
o
vi
de
d
b
y
c
lo
u
d
c
om
put
in
g,
it
b
r
i
ngs
s
ig
ni
f
ic
a
n
t
s
e
c
ur
it
y
c
ha
l
le
n
ge
s
.
R
e
s
e
a
r
c
h
by
S
h
a
r
m
a
a
nd
S
in
gh
[
2
]
s
ho
w
s
t
ha
t
d
is
t
r
i
bu
te
d
de
ni
a
l
o
f
s
e
r
v
ic
e
s
(
D
D
o
S
)
a
t
ta
c
ks
a
r
e
s
ti
ll
a
m
a
j
or
t
hr
e
a
t
i
n
c
lo
ud
e
n
vi
r
o
nm
e
nt
s
.
T
h
e
s
e
a
tt
a
c
ks
a
i
m
to
m
a
ke
c
lo
ud
s
e
r
vi
c
e
s
in
a
c
c
e
s
s
i
bl
e
t
o
le
g
it
im
a
te
us
e
r
s
by
f
lo
od
in
g
s
e
r
ve
r
s
a
nd
ne
t
w
o
r
ks
w
i
th
f
a
ke
tr
a
f
f
ic
a
n
d
di
s
r
up
ti
ng
th
e
r
e
g
ul
a
r
ope
r
a
t
io
n
o
f
w
e
bs
i
te
s
,
a
ppl
ic
a
ti
ons
,
a
pp
li
c
a
ti
on
p
r
o
g
r
a
m
m
i
ng
i
nt
e
r
f
a
c
e
s
(
A
P
I
s
)
,
a
nd
ot
he
r
s
e
r
vi
c
e
s
[
3
]
,
[
4
]
.
T
he
i
m
p
a
c
t
is
s
ig
n
i
f
ic
a
nt
o
n
s
e
r
v
ic
e
a
va
il
a
bi
li
ty
i
n
c
lo
ud
e
nv
i
r
on
m
e
n
ts
.
T
he
r
e
f
o
r
e
,
m
or
e
e
f
f
e
c
t
iv
e
de
te
c
ti
on
m
e
th
ods
a
r
e
ne
e
de
d
to
c
ou
nt
e
r
t
h
e
s
e
a
tt
a
c
ks
.
T
he
s
ugge
s
te
d
m
e
th
ods
h
a
ve
not
be
e
n
te
s
te
d
a
ga
in
s
t
m
a
ny
D
D
oS
a
tt
a
c
k
va
r
ia
nt
s
,
de
s
pi
te
th
e
f
a
c
t
th
a
t
a
lo
t
of
r
e
s
e
a
r
c
h
ha
s
be
e
n
done
to
de
te
c
t
D
D
oS
a
tt
a
c
ks
in
c
lo
ud
c
om
put
in
g.
T
he
tr
a
f
f
ic
m
ovi
ng
th
r
oug
h
th
e
c
lo
ud
e
nvi
r
onm
e
nt
is
ne
it
he
r
uni
f
or
m
nor
pa
r
ti
c
ul
a
r
ly
v
a
r
ie
d,
m
uc
h
li
ke
th
e
in
te
r
ne
t
.
T
o
a
c
c
ur
a
te
ly
id
e
nt
if
y
di
f
f
e
r
e
nt
f
o
r
m
s
of
D
D
oS
a
tt
a
c
ks
,
e
m
pl
oyi
ng
a
m
e
th
od
th
a
t
c
a
n
e
f
f
ic
ie
nt
ly
f
il
te
r
a
nd
e
xt
r
a
c
t
r
e
le
va
nt
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
A
r
ti
f
I
nt
e
ll
,
V
ol
. 14, No. 5, O
c
to
be
r
2025
:
3945
-
3957
3946
in
f
or
m
a
ti
on
(
f
e
a
tu
r
e
s
)
is
ne
c
e
s
s
a
r
y.
I
n
or
de
r
to
r
e
duc
e
th
e
m
a
ny
ty
pe
s
of
D
D
oS
a
tt
a
c
ks
in
a
c
lo
ud
c
om
put
in
g
e
nvi
r
onm
e
nt
,
a
n
in
tr
us
io
n
de
te
c
ti
on
s
y
s
te
m
(
I
D
S
)
th
a
t
is
bot
h
de
pe
nda
bl
e
a
nd
e
f
f
ic
ie
nt
is
ne
c
e
s
s
a
r
y.
T
hi
s
r
e
s
e
a
r
c
h
a
im
s
to
r
e
c
ogni
z
e
di
f
f
e
r
e
nt
ty
pe
s
of
D
D
oS
a
s
s
a
ul
t
s
in
s
id
e
a
c
lo
ud
c
om
put
in
g
e
nvi
r
onm
e
nt
by
c
r
e
a
ti
ng
a
r
obus
t
m
ode
l.
P
r
e
vi
ous
r
e
s
e
a
r
c
h,
in
c
lu
di
ng
O
m
e
r
e
t
al
.
[
5]
a
nd
H
e
e
t
al
.
[
6]
,
ha
ve
e
m
pl
oye
d
di
ve
r
s
e
a
lg
or
it
hm
s
s
uc
h a
s
lo
gi
s
ti
c
r
e
gr
e
s
s
io
n, s
uppor
t
ve
c
to
r
m
a
c
hi
ne
,
de
c
is
io
n t
r
e
e
(
D
T
)
,
n
a
ïv
e
B
a
ye
s
(
N
B
)
,
r
a
ndom
f
or
e
s
t
(
R
F
)
,
K
M
e
a
ns
,
a
nd
G
a
us
s
ia
n
e
xpe
c
ta
ti
on
-
m
a
xi
m
iz
a
ti
on
to
id
e
nt
i
f
y
D
D
oS
a
tt
a
c
ks
,
e
nc
om
pa
s
s
in
g
f
lo
odi
ng,
s
poof
in
g,
a
nd
br
ut
e
-
f
or
c
e
a
tt
a
c
ks
.
T
h
e
te
s
t
f
in
di
ngs
in
di
c
a
te
d
a
pr
e
c
i
s
io
n
le
ve
l
of
99.7%
w
it
h
a
ne
gl
ig
ib
le
f
a
l
s
e
po
s
it
iv
e
r
a
te
(
F
P
R
)
of
unde
r
0.0
7%
.
A
di
f
f
e
r
e
nt
r
e
s
e
a
r
c
h
[
7]
us
e
s
le
a
s
t
s
qua
r
e
s
uppor
t
ve
c
to
r
m
a
c
hi
ne
(
LS
-
S
V
M
)
to
id
e
nt
i
f
y
tr
a
ns
m
is
s
io
n
c
ont
r
ol
pr
ot
oc
ol
(
T
C
P
)
f
lo
od
a
s
s
a
ul
ts
w
it
h
a
pr
e
c
is
io
n
r
a
te
of
97%
.
S
tu
dy
of
C
he
n
e
t
al
.
[
8]
ut
il
iz
e
d
e
xt
r
e
m
e
gr
a
di
e
nt
boos
ti
ng
(
X
G
B
oos
t)
to
de
te
c
t
in
te
r
ne
t
c
ont
r
ol
m
e
s
s
a
ge
pr
ot
oc
ol
(
I
C
M
P
)
f
lo
odi
ng,
T
C
P
f
lo
odi
ng,
T
C
P
-
s
ync
hr
oni
z
e
(
S
Y
N
)
f
lo
odi
ng,
us
e
r
da
ta
gr
a
m
pr
ot
oc
ol
(
UDP
)
f
lo
odi
ng,
a
nd
S
m
ur
f
a
tt
a
c
ks
,
a
c
hi
e
vi
ng
a
pr
e
c
is
io
n
r
a
te
o
f
98.5%
.
I
n
th
e
s
tu
dy
o
f
W
a
ni
e
t
al
.
[
9]
,
r
e
s
e
a
r
c
he
r
s
pr
e
s
e
nt
e
d
a
c
om
bi
na
ti
on
of
th
e
hi
dde
n
M
a
r
kov
m
ode
l
a
nd
RF
to
de
te
c
t
D
D
oS
a
tt
a
c
ks
.
T
hi
s
a
ppr
oa
c
h
a
c
hi
e
ve
d
a
n
a
c
c
ur
a
c
y
of
97.34%
a
n
d
a
pr
e
c
is
io
n
v
a
lu
e
of
95.45%
.
A
s
tu
dy
of
K
us
hw
a
h
a
nd
A
li
[
10]
in
tr
oduc
e
d
a
vot
in
g
e
xt
r
e
m
e
le
a
r
ni
ng
m
a
c
hi
ne
(V
-
E
L
M
)
to
de
te
c
t
D
D
oS
a
tt
a
c
ks
.
T
he
e
f
f
e
c
ti
ve
ne
s
s
of
th
is
m
e
th
od
w
a
s
e
va
lu
a
te
d
us
in
g
two
da
ta
s
e
t
s
,
na
m
e
ly
N
S
L
-
K
D
D
a
nd
I
S
C
X
,
r
e
s
ul
ti
ng
i
n
a
c
c
ur
a
c
ie
s
of
99.18%
a
nd 92.11%
, r
e
s
pe
c
ti
ve
ly
.
F
ur
th
e
r
m
or
e
,
m
a
c
hi
ne
le
a
r
ni
ng
te
c
hni
que
s
a
r
e
e
xt
e
ns
iv
e
ly
e
m
pl
oye
d
f
or
th
e
de
te
c
ti
on
of
D
D
o
S
a
tt
a
c
ks
[
11]
–
[
13]
.
N
e
ve
r
th
e
le
s
s
,
c
e
r
ta
in
s
tu
di
e
s
a
l
s
o
ut
il
iz
e
f
e
a
tu
r
e
s
e
le
c
ti
on
to
e
nha
nc
e
de
te
c
ti
on.
A
n
il
lu
s
tr
a
ti
ve
s
tu
dy
of
B
a
gya
la
ks
hm
i
a
nd
S
a
m
unde
e
s
w
a
r
i
[
14]
us
in
g
f
e
a
tu
r
e
s
e
le
c
ti
on
te
c
hni
que
s
us
in
g
le
a
r
ni
ng
ve
c
to
r
qua
nt
iz
a
ti
on
(
L
V
Q
)
a
nd
pr
in
c
ip
a
l
c
om
pone
nt
a
na
ly
s
is
(
P
C
A
)
,
w
hi
c
h
a
r
e
th
e
n
us
e
d
f
or
B
a
ye
s
ia
n
c
la
s
s
if
ie
r
,
s
uppor
t
v
e
c
to
r
c
la
s
s
if
ie
r
,
a
nd
tr
e
e
-
ba
s
e
d
c
la
s
s
if
ie
r
.
T
he
te
s
t
f
in
di
ngs
in
di
c
a
te
th
a
t
th
e
L
V
Q
a
nd
D
T
a
lg
or
it
hm
s
a
c
hi
e
ve
d
a
n
a
c
c
ur
a
c
y
of
98.74%
,
w
hi
le
th
e
P
C
A
a
nd
DT
a
lg
or
it
hm
s
a
c
hi
e
ve
d
a
n
a
c
c
ur
a
c
y
of
98.60%
.
R
e
s
e
a
r
c
he
r
s
ha
v
e
in
te
gr
a
te
d
f
e
a
tu
r
e
s
e
le
c
ti
on
w
it
h
de
e
p
le
a
r
ni
ng
in
th
e
ir
w
or
k.
F
or
in
s
ta
nc
e
,
a
s
tu
dy
of
S
a
iS
in
dhuT
he
ja
a
nd
S
hya
m
[
15]
ha
s
s
ugge
s
te
d
c
om
bi
ni
ng
oppos
it
io
na
l
c
r
ow
s
e
a
r
c
h
a
lg
or
it
hm
(
O
C
S
A
)
f
e
a
tu
r
e
s
e
le
c
ti
on
w
it
h
a
r
e
c
ur
r
e
nt
ne
ur
a
l
ne
twor
k
(
R
N
N
)
to
de
t
e
c
t
D
D
oS
a
tt
a
c
k
s
.
T
he
pr
opos
e
d
m
e
th
od
w
a
s
te
s
te
d
u
s
in
g
th
e
C
I
C
I
D
S
2017
da
ta
s
e
t
a
nd
a
c
hi
e
v
e
d
a
n
a
c
c
ur
a
c
y
of
94.12%
.
T
he
s
tu
dy
by
A
ga
r
w
a
l
e
t
al
.
[
16]
pr
e
s
e
nt
s
th
e
us
e
of
th
e
w
ha
le
opt
im
iz
a
ti
on
a
lg
or
it
hm
(
W
O
A
)
f
or
f
e
a
tu
r
e
s
e
le
c
ti
on
in
c
om
bi
na
ti
on
w
it
h
a
de
e
p
ne
ur
a
l
ne
twor
k
(
D
N
N
)
.
T
h
e
a
lg
or
it
hm
w
a
s
e
v
a
lu
a
te
d
u
s
in
g
th
e
K
D
D
-
C
U
P
97
d
a
ta
s
e
t
a
nd
a
c
hi
e
ve
d
a
n
a
c
c
ur
a
c
y of
95.35%
.
T
hi
s
r
e
s
e
a
r
c
h
in
ve
s
ti
ga
te
s
th
e
im
pa
c
t
of
us
in
g
a
hybr
id
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
od.
W
hi
le
pr
e
vi
ous
s
tu
di
e
s
ha
ve
e
xpl
or
e
d
th
e
r
ol
e
of
f
e
a
tu
r
e
s
e
le
c
ti
on
in
e
nha
nc
in
g
th
e
pe
r
f
or
m
a
nc
e
of
D
D
oS
de
te
c
ti
on
s
ys
te
m
s
,
th
e
y
ha
ve
not
e
xpl
ic
it
ly
e
x
a
m
in
e
d
it
s
e
f
f
e
c
t
s
on
D
D
oS
de
te
c
ti
on
s
ys
t
e
m
s
w
it
hi
n
c
lo
ud
c
om
put
in
g
e
nvi
r
onm
e
nt
s
th
r
ough
hybr
id
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
od
s
.
T
hi
s
s
tu
dy
pr
opos
e
s
a
de
te
c
ti
on
m
ode
l
f
or
m
e
d
by
c
om
bi
ni
ng
f
e
a
tu
r
e
s
e
le
c
ti
on,
f
e
a
tu
r
e
e
xt
r
a
c
ti
on,
a
nd
m
a
c
hi
ne
le
a
r
ni
ng
te
c
hni
que
s
.
F
e
a
tu
r
e
s
e
le
c
ti
on
te
c
hni
que
s
a
r
e
u
s
e
d
to
r
e
duc
e
ir
r
e
le
va
nt
f
e
a
tu
r
e
s
.
T
hi
s
s
tu
dy
ut
il
iz
e
s
in
f
or
m
a
ti
on
ga
in
(
I
G
)
c
om
bi
ne
d
w
it
h
P
C
A
to
pr
oduc
e
opt
im
a
l
f
e
a
tu
r
e
s
th
a
t
c
a
n
id
e
nt
if
y
va
r
ia
ti
ons
of
D
D
oS
a
tt
a
c
ks
.
T
hi
s
m
e
th
od
is
c
a
ll
e
d
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on.
T
he
m
a
c
hi
ne
le
a
r
ni
ng
m
e
th
ods
a
ppl
ie
d
in
th
is
s
tu
dy
in
c
lu
de
N
B
,
C
4.5,
a
nd
R
F
.
T
hi
s
w
or
k
f
oc
us
e
s
on
th
e
im
pr
ove
m
e
nt
m
e
c
ha
ni
s
m
by
pr
opos
in
g
a
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
to
c
ount
e
r
D
D
oS
a
tt
a
c
k
s
on
c
lo
ud
c
om
put
in
g
ne
twor
k
s
.
I
n
a
ddi
ti
on,
th
i
s
s
tu
dy
pr
ovi
de
s
s
e
v
e
r
a
l
c
ont
r
ib
ut
io
ns
:
i)
a
ddr
e
s
s
th
e
c
r
it
ic
a
l
ne
e
d
f
or
a
r
obus
t
de
te
c
ti
on
s
ys
te
m
m
ode
l
th
a
t
c
a
n
e
f
f
e
c
ti
ve
ly
id
e
nt
if
y
di
f
f
e
r
e
nt
ty
pe
s
of
D
D
o
S
a
s
s
a
ul
ts
on
c
lo
ud
c
om
put
in
g
ne
twor
ks
;
ii
)
ut
il
iz
in
g
a
two
-
s
ta
g
e
f
e
a
tu
r
e
s
e
le
c
ti
on
a
ppr
oa
c
h,
th
i
s
pa
pe
r
w
il
l
in
tr
oduc
e
a
n
opt
im
iz
e
d
de
te
c
ti
on
m
e
th
od
f
or
m
it
ig
a
ti
ng
D
D
oS
a
tt
a
c
k
s
in
s
pe
c
if
ic
c
lo
ud
c
om
put
in
g
n
e
twor
ks
;
ii
i)
e
va
lu
a
ti
ng
a
nd
a
s
s
e
s
s
in
g
th
e
in
f
lu
e
nc
e
of
f
e
a
tu
r
e
s
e
le
c
ti
on
a
nd
e
xt
r
a
c
ti
on
on
th
e
e
f
f
ic
a
c
y
of
th
e
D
D
oS
a
tt
a
c
k
de
te
c
ti
on
m
od
e
l
ut
il
iz
in
g
a
c
l
a
s
s
if
ic
a
ti
on
m
e
th
odol
ogy
;
iv
)
de
ve
lo
p
a
hybr
id
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
odol
ogy uti
li
z
in
g a
t
w
o
-
s
te
p pr
oc
e
s
s
t
ha
t
in
c
or
por
a
te
s
f
e
a
t
ur
e
s
e
le
c
ti
on t
hr
ough I
G
a
nd
f
e
a
tu
r
e
e
xt
r
a
c
ti
on
vi
a
P
C
A
to
id
e
nt
if
y
th
e
m
os
t
pe
r
ti
ne
nt
f
e
a
tu
r
e
s
f
or
id
e
nt
if
yi
ng
di
ve
r
s
e
ve
r
s
io
ns
of
D
D
oS
a
tt
a
c
ks
;
v)
c
om
pr
e
he
ns
iv
e
e
va
lu
a
ti
on
us
in
g
th
e
C
I
C
I
oT
2023
da
ta
s
e
t
a
n
d
m
ul
ti
pl
e
c
la
s
s
if
ie
r
s
(
D
T
,
R
F
,
a
nd
N
B
)
;
a
nd
vi
)
im
pr
ove
d
de
te
c
ti
on pe
r
f
or
m
a
nc
e
, a
c
hi
e
vi
ng up to 99%
a
c
c
ur
a
c
y w
it
h D
T
a
nd
R
F
c
la
s
s
if
ie
r
s
.
T
he
r
e
m
a
in
de
r
of
th
is
w
o
r
k
is
s
tr
uc
tu
r
e
d
a
s
f
ol
lo
w
s
.
S
e
c
ti
on
2
de
s
c
r
ib
e
s
th
e
e
xpe
r
im
e
nt
a
l
s
e
tt
in
g,
de
ta
il
in
g
e
a
c
h
pha
s
e
of
th
e
r
e
s
e
a
r
c
h,
th
e
m
e
th
odol
ogy
e
m
pl
oye
d,
th
e
da
ta
a
c
qui
s
it
io
n,
a
nd
th
e
e
va
lu
a
ti
on
m
e
tr
ic
.
S
e
c
ti
on
3
de
s
c
r
ib
e
s
th
e
e
xpe
r
im
e
nt
a
l
out
c
om
e
s
a
nd
r
e
s
e
a
r
c
h
f
in
di
ngs
.
U
lt
im
a
te
ly
,
s
e
c
ti
on
4
s
um
m
a
r
iz
e
s
th
e
pr
in
c
ip
a
l
f
in
di
ngs
of
th
is
a
r
ti
c
le
,
a
s
w
e
ll
a
s
pr
os
pe
c
ti
ve
di
r
e
c
ti
ons
a
nd
oppor
tu
ni
ti
e
s
f
or
f
ut
ur
e
r
e
s
e
a
r
c
h.
2.
M
E
T
H
O
D
T
hi
s
s
tu
dy
e
m
pl
oys
a
two
-
s
ta
ge
f
e
a
tu
r
e
s
e
l
e
c
ti
on
m
e
th
o
dol
ogy
to
id
e
nt
if
y
D
D
oS
a
s
s
a
ul
ts
.
T
he
m
e
th
ods
u
s
e
d
f
or
de
te
c
ti
on
a
r
e
D
T
,
R
F
s
,
a
nd
N
B
.
T
hi
s
s
e
c
ti
on
out
li
ne
s
th
e
s
e
que
nt
ia
l
pr
oc
e
dur
e
s
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
A
r
ti
f
I
nt
e
ll
I
S
S
N
:
2252
-
8938
T
w
o
-
s
te
ps
f
e
at
ur
e
s
e
le
c
ti
on f
or
de
te
c
ti
on v
a
r
ia
nt
di
s
tr
ib
ut
e
d de
ni
al
of
s
e
r
v
ic
e
s
at
ta
c
k
…
(
K
ur
ni
abudi)
3947
r
e
qui
r
e
d
to
c
a
r
r
y
out
th
is
s
tu
dy
s
u
c
c
e
s
s
f
ul
ly
.
T
he
c
om
po
ne
nt
s
e
nc
om
pa
s
s
e
d
in
th
is
a
r
e
th
e
da
ta
s
e
t,
e
xpe
r
im
e
nt
a
l
s
e
tt
in
g,
f
e
a
tu
r
e
s
e
l
e
c
ti
on
a
ppr
oa
c
h,
two
-
s
ta
g
e
f
e
a
tu
r
e
s
e
le
c
ti
on,
c
la
s
s
if
ic
a
ti
on
a
lg
or
it
hm
,
a
nd
e
xpe
r
im
e
nt
a
l
in
s
tr
um
e
nt
s
.
2
.1.
E
xp
e
r
im
e
n
t
s
e
t
u
p
T
hi
s
pr
oj
e
c
t
a
i
m
s
to
ta
c
kl
e
s
e
c
ur
it
y
c
onc
e
r
ns
in
c
l
oud
c
o
m
pu
ti
ng
,
p
a
r
ti
c
ul
a
r
ly
D
D
oS
a
t
ta
c
ks
.
D
D
o
S
a
t
ta
c
ks
e
xh
ib
it
s
e
ve
r
a
l
va
r
ia
ti
ons
;
how
e
ve
r
,
f
e
w
s
tu
di
e
s
h
a
ve
a
dd
r
e
s
s
e
d
th
is
t
opi
c
.
T
h
is
pa
pe
r
pr
opos
e
s
a
two
-
s
te
p
te
c
h
ni
que
to
e
n
ha
n
c
e
th
e
a
c
c
u
r
a
c
y
o
f
t
h
e
I
D
S
in
id
e
nt
i
f
yi
ng
di
v
e
r
s
e
f
o
r
m
s
o
f
D
D
o
S
a
tt
a
c
ks
.
T
h
is
s
tu
dy
t
ho
r
o
ugh
ly
a
na
l
yz
e
s
s
e
ve
r
a
l
pr
oc
e
du
r
e
s
,
i
nc
lu
di
ng
f
e
a
t
u
r
e
s
e
le
c
ti
on
f
r
om
D
D
o
S
a
tt
a
c
k
da
ta
s
e
ts
,
f
e
a
tu
r
e
e
x
t
r
a
c
t
io
n
t
o
de
r
i
ve
pe
r
t
in
e
nt
f
e
a
tu
r
e
s
,
da
ta
s
e
t
a
l
lo
c
a
ti
on
f
o
r
t
r
a
in
in
g
a
nd
te
s
t
in
g,
a
nd
t
he
de
ve
lo
p
m
e
n
t
of
a
n
I
D
S
u
ti
li
z
i
ng
R
F
,
D
T
,
a
nd
N
B
te
c
hn
iq
ue
s
.
T
he
e
x
pe
r
im
e
nt
a
l
s
e
tu
p,
th
e
c
e
n
t
r
a
l
c
om
p
one
nt
of
th
is
r
e
s
e
a
r
c
h,
is
s
e
pa
r
a
te
d
in
t
o
f
ou
r
pa
r
ts
,
e
a
c
h
of
w
hi
c
h
w
il
l
be
f
u
r
t
he
r
di
s
c
us
s
e
d
in
th
e
f
o
ll
ow
i
ng
s
e
c
t
io
ns
.
i)
F
il
te
r
in
g D
D
oS
a
tt
a
c
k f
r
om
C
I
C
I
oT
23 da
ta
s
e
t,
w
he
r
e
s
e
v
e
r
a
l
D
D
oS
a
tt
a
c
ks
a
nd r
e
gul
a
r
t
r
a
f
f
ic
e
xi
s
t.
ii)
N
e
xt
,
th
e
D
D
oS
da
ta
s
e
t
i
s
s
ubj
e
c
te
d
to
f
e
a
tu
r
e
s
e
le
c
ti
on
f
or
th
e
de
te
c
ti
on
pr
oc
e
s
s
u
s
in
g
I
G
,
P
C
A
,
a
nd
two
-
s
te
p f
e
a
tu
r
e
s
e
le
c
ti
on (
hybr
id
I
G
-
P
C
A
)
.
iii)
T
hi
r
d
,
c
om
pa
r
is
on
a
nd
a
na
ly
s
is
of
te
s
ti
ng
a
c
c
ur
a
c
y
us
in
g
R
F
,
D
T
,
a
nd
N
B
m
e
th
ods
f
or
e
a
c
h
f
e
a
tu
r
e
s
e
le
c
ti
on me
th
od.
iv
)
F
in
a
ly
, va
li
da
ti
on r
e
s
ul
t
of
m
ode
l’
s
da
ta
s
pl
it
, 5
-
c
r
os
s
va
li
da
ti
o
n a
nd 10
-
c
r
os
s
va
li
da
ti
on.
T
he
e
xpe
r
im
e
nt
a
l
s
t
a
ge
s
i
n t
hi
s
s
tu
dy a
r
e
s
how
n i
n F
ig
ur
e
1.
F
ig
ur
e
1. R
e
s
e
a
r
c
h
e
x
pe
r
im
e
nt
2
.
2
.
D
D
oS
d
at
as
e
t
T
hi
s
s
tu
dy
ut
il
iz
e
d
th
e
C
I
C
I
oT
2023
d
a
ta
s
e
t
de
ve
lo
pe
d
by
th
e
U
ni
ve
r
s
it
y
of
N
e
w
B
r
uns
w
ic
k,
C
a
na
da
[
17]
.
T
hi
s
c
ol
le
c
ti
on
c
ont
a
in
s
tr
a
f
f
ic
a
s
s
oc
ia
te
d
w
it
h
s
e
c
ur
it
y
d
a
ta
f
r
om
in
te
r
ne
t
of
th
in
gs
de
vi
c
e
s
a
nd
c
lo
ud
c
om
put
in
g.
T
he
da
ta
in
th
is
da
t
a
s
e
t
in
c
lu
de
s
va
r
io
us
va
r
ia
bl
e
s
f
r
om
T
C
P
/I
P
c
on
s
is
ti
ng
of
47
f
e
a
tu
r
e
s
.
I
n
a
ddi
ti
on,
th
is
da
ta
s
e
t
c
a
n
a
ls
o
c
ov
e
r
s
e
ve
r
a
l
a
tt
a
c
k
s
c
e
na
r
io
s
,
but
th
is
s
tu
dy
onl
y
f
oc
us
e
s
on
D
D
oS
a
tt
a
c
ks
.
T
hi
s
s
tu
dy
di
d
not
ut
il
iz
e
a
ll
th
e
a
va
il
a
bl
e
d
a
ta
s
e
t
s
ow
in
g
t
o
r
e
s
our
c
e
c
ons
tr
a
in
ts
.
T
a
bl
e
1
pr
e
s
e
nt
s
th
e
qua
nt
it
y a
nd c
la
s
s
if
ic
a
ti
on of
D
D
oS
a
tt
a
c
k
s
e
m
pl
oye
d i
n t
hi
s
s
tu
dy.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
A
r
ti
f
I
nt
e
ll
,
V
ol
. 14, No. 5, O
c
to
be
r
2025
:
3945
-
3957
3948
T
a
bl
e
1.
N
um
be
r
of
D
D
oS
a
tt
a
c
ks
T
ype
s
of
a
t
t
a
c
k
A
m
ount
s
D
D
oS
-
I
C
M
P
_F
l
ood
74579
D
D
oS
-
U
D
P
_F
l
ood
55800
D
D
oS
-
T
C
P
_F
l
ood
46377
D
D
oS
-
P
S
H
A
C
K
_F
l
ood
42288
D
D
oS
-
S
Y
N
_F
l
ood
42136
D
D
oS
-
R
S
T
F
I
N
F
l
ood
41586
D
D
oS
-
S
ynonym
ous
I
P
_F
l
ood
37354
B
e
ni
gnT
r
a
f
f
i
c
11423
D
D
oS
-
I
C
M
P
_F
r
a
gm
e
nt
a
t
i
on
4589
D
D
oS
-
A
C
K
_F
r
a
gm
e
nt
a
t
i
on
2992
D
D
oS
-
U
D
P
_F
r
a
gm
e
nt
a
t
i
on
2956
D
D
oS
-
H
T
T
P
_
F
l
ood
331
D
D
oS
-
S
l
ow
L
or
i
s
243
2
.
3
.
I
n
f
or
m
at
io
n
gai
n
T
he
c
om
m
onl
y
u
s
e
d
s
tr
a
te
gy
f
or
s
e
le
c
ti
ng
da
ta
s
e
t
f
e
a
tu
r
e
s
is
IG
,
w
hi
c
h
a
c
ts
a
s
a
f
il
te
r
.
T
hi
s
m
e
th
od
s
e
e
ks
to
m
it
ig
a
te
in
te
r
f
e
r
e
nc
e
r
e
s
ul
ti
ng
f
r
om
e
xt
r
a
ne
ous
f
e
a
tu
r
e
s
by
e
m
pl
oyi
ng
a
s
tr
a
ig
ht
f
or
w
a
r
d
a
tt
r
ib
ut
e
r
a
nki
ng
te
c
hni
que
,
f
ol
lo
w
e
d
by
id
e
nt
if
yi
ng
f
e
a
tu
r
e
s
th
a
t
pos
s
e
s
s
th
e
hi
ghe
s
t
in
f
or
m
a
ti
on
c
ont
e
nt
in
s
id
e
a
s
pe
c
if
ic
c
la
s
s
.
F
e
a
tu
r
e
e
nt
r
opy
e
va
lu
a
ti
on
is
e
m
pl
oye
d
to
di
s
c
e
r
n
e
xc
e
pt
io
na
l
c
ha
r
a
c
te
r
is
ti
c
s
[
18]
.
T
he
IG
a
lg
or
it
hm
w
a
s
c
hos
e
n
a
s
a
f
e
a
tu
r
e
s
e
le
c
ti
on
te
c
hni
que
be
c
a
us
e
IG
is
e
f
f
e
c
ti
ve
in
r
e
duc
in
g
f
e
a
tu
r
e
di
m
e
ns
io
ns
by
s
e
le
c
ti
ng
th
e
m
os
t
r
e
le
va
nt
a
nd
in
f
or
m
a
ti
ve
a
tt
r
ib
ut
e
s
,
th
e
r
e
by
s
ig
ni
f
ic
a
nt
ly
in
c
r
e
a
s
in
g
th
e
a
c
c
ur
a
c
y
of
th
e
c
la
s
s
if
ic
a
ti
on
m
ode
l
.
I
n
a
ddi
ti
on,
IG
is
e
a
s
y
to
c
a
lc
ul
a
te
a
nd
is
of
te
n
us
e
d
in
va
r
io
us
da
ta
pr
oc
e
s
s
in
g
a
ppl
ic
a
ti
ons
, he
lp
in
g t
o e
li
m
in
a
te
i
r
r
e
le
va
nt
f
e
a
tu
r
e
s
t
ha
t
c
a
n i
nt
e
r
f
e
r
e
w
it
h t
he
pe
r
f
o
r
m
a
nc
e
of
t
he
m
ode
[
19
]
.
IG
de
te
r
m
in
e
s
f
e
a
tu
r
e
r
a
nki
ng,
w
hi
c
h
c
ons
id
e
r
s
w
e
ig
ht
va
lu
e
s
a
nd
m
in
im
um
w
e
ig
ht
s
.
I
n
th
is
s
tu
dy,
th
e
or
ig
in
a
l
s
e
t
of
47
f
e
a
tu
r
e
s
w
a
s
r
e
duc
e
d
to
a
f
in
a
l
s
e
t
of
10
by
f
il
te
r
in
g.
M
or
e
ove
r
,
th
e
c
hos
e
n
c
ha
r
a
c
te
r
is
ti
c
s
w
il
l
be
ut
il
iz
e
d
to
de
te
c
t
D
D
oS
a
tt
a
c
ks
in
c
lo
ud
c
om
put
in
g.
T
he
I
G
c
a
lc
ul
a
ti
on
c
a
n
be
e
xpr
e
s
s
e
d
m
a
th
e
m
a
ti
c
a
ll
y us
in
g
(
1
)
.
(
,
)
=
(
)
−
(
|
)
(
1)
W
he
r
e
H
(
Y
)
i
s
t
he
e
nt
r
opy of
t
he
t
a
r
ge
t
Y
, a
nd H
(
Y
∣
X
i
)
i
s
th
e
c
ondi
ti
ona
l
e
nt
r
opy of
Y
gi
ve
n X
i
.
2
.
4
.
P
r
in
c
ip
al
c
om
p
on
e
n
t
an
al
ys
is
I
n
th
e
f
ie
ld
of
m
a
c
hi
ne
le
a
r
ni
ng,
P
C
A
is
a
di
m
e
n
s
io
na
li
ty
r
e
d
uc
ti
on
te
c
hni
que
th
a
t
is
e
m
pl
oye
d
to
s
im
pl
if
y
a
da
ta
s
e
t
w
hi
le
ke
e
pi
ng
c
r
it
ic
a
l
in
f
or
m
a
ti
on.
P
C
A
f
unc
ti
ons
by
di
s
c
e
r
ni
ng
pa
tt
e
r
ns
w
it
hi
n
th
e
da
ta
a
nd
c
a
te
gor
iz
in
g
a
s
s
o
c
ia
te
d
va
r
ia
bl
e
s
in
to
unc
or
r
e
la
te
d
p
r
in
c
ip
a
l
c
om
pone
nt
s
[
20]
,
[
21]
.
T
hi
s
m
e
th
od
c
a
n
be
ut
il
iz
e
d
f
or
f
e
a
tu
r
e
e
xt
r
a
c
ti
on
(
ge
ne
r
a
ti
ng
ne
w
f
e
a
tu
r
e
s
)
or
f
e
a
t
ur
e
s
e
le
c
ti
on
(
c
hoos
in
g a
s
ub
s
e
t
of
th
e
or
ig
in
a
l
f
e
a
tu
r
e
s
)
,
c
ont
in
ge
nt
upon
th
e
a
na
ly
ti
c
a
l
r
e
qui
r
e
m
e
nt
s
[
22]
.
T
hi
s
s
tu
dy
w
il
l
r
e
duc
e
th
e
di
m
e
ns
io
na
li
ty
w
it
h
P
C
A
f
r
om
47
to
10
f
e
a
tu
r
e
s
.
M
a
c
hi
ne
le
a
r
ni
ng
w
il
l
th
e
n
us
e
th
e
s
e
f
e
a
tu
r
e
s
in
th
e
c
la
s
s
if
ic
a
ti
on
tr
a
in
in
g
pr
oc
e
s
s
.
P
C
A
ha
s
f
iv
e
s
ta
ge
s
of
da
ta
s
ta
nda
r
di
z
a
ti
on:
c
ova
r
ia
nc
e
m
e
tr
ic
s
,
e
ig
e
nve
c
to
r
s
a
nd
e
ig
e
nva
lu
e
s
,
pr
in
c
ip
a
l
c
om
pone
nt
s
,
a
nd
da
ta
tr
a
ns
f
or
m
a
ti
on.
M
a
th
e
m
a
ti
c
a
ll
y,
da
ta
s
ta
nda
r
di
z
a
ti
on
is
in
(
2
)
,
a
nd
da
ta
tr
a
ns
f
or
m
a
ti
on i
s
i
n
(
3
)
.
=
−
(
2)
=
(
3)
W
he
r
e
Z
i
s
t
he
da
ta
a
nd V
s
e
le
c
te
d i
s
t
he
m
a
tr
ix
of
s
e
le
c
te
d
e
ig
e
nve
c
to
r
s
.
2
.
5
.
T
w
o
-
s
t
e
p
f
e
at
u
r
e
s
e
le
c
t
io
n
(
H
yb
r
id
I
G
-
P
C
A
)
T
hi
s
s
tu
dy
pr
im
a
r
il
y
a
im
s
to
pr
e
s
e
nt
a
two
-
s
te
p
m
e
th
o
dol
ogy
f
or
f
e
a
tu
r
e
s
e
le
c
ti
on.
T
hi
s
m
e
th
odol
ogy
is
r
e
f
e
r
r
e
d
to
a
s
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on,
e
m
pl
oyi
ng
bot
h
hybr
id
f
e
a
tu
r
e
s
e
le
c
ti
on
a
lo
ng
w
it
h
f
e
a
tu
r
e
e
xt
r
a
c
ti
on
te
c
hni
que
s
.
T
hi
s
a
ppr
oa
c
h
a
im
s
to
opt
im
iz
e
th
e
de
te
c
ti
on
s
ys
te
m
on
th
e
c
lo
ud
c
om
put
in
g
ne
twor
k
in
th
e
f
e
a
tu
r
e
s
e
l
e
c
ti
on
pr
oc
e
s
s
.
T
he
f
ir
s
t
s
te
p
is
to
s
e
l
e
c
t
f
e
a
tu
r
e
s
us
in
g
I
G
a
nd
di
vi
de
th
e
m
in
to
te
n
f
e
a
tu
r
e
s
.
T
he
n,
th
e
r
e
s
ul
ts
of
I
G
s
e
r
ve
a
s
in
put
f
or
th
e
P
C
A
m
e
th
od
in
to
e
ig
ht
f
e
a
tu
r
e
s
.
T
he
c
om
bi
na
ti
on
of
th
e
t
w
o m
e
th
ods
c
a
n be
f
or
m
ul
a
te
d a
s
f
ol
lo
w
s
:
i)
F
e
a
tu
r
e
s
e
le
c
ti
on:
s
e
l
e
c
t
a
s
ub
s
e
t
of
X
I
G
f
e
a
tu
r
e
s
ba
s
e
d on the
I
G
va
lu
e
I
G
(
X
i,
Y
)
a
s
s
how
n i
n (
4)
.
=
{
|
(
,
)
>
ℎ
ℎ
}
(
4)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
A
r
ti
f
I
nt
e
ll
I
S
S
N
:
2252
-
8938
T
w
o
-
s
te
ps
f
e
at
ur
e
s
e
le
c
ti
on f
or
de
te
c
ti
on v
a
r
ia
nt
di
s
tr
ib
ut
e
d de
ni
al
of
s
e
r
v
ic
e
s
at
ta
c
k
…
(
K
ur
ni
abudi)
3949
ii)
D
im
e
ns
io
na
li
ty
r
e
duc
ti
on:
a
ppl
y
P
C
A
to
th
e
s
e
le
c
te
d
f
e
a
tu
r
e
s
to
obt
a
in
da
ta
w
it
h
lo
w
e
r
di
m
e
n
s
io
ns
X
P
C
A
a
s
s
ho
w
n i
n (
5)
.
=
(
)
(5
)
T
hi
s
pr
oc
e
s
s
pr
oduc
e
s
f
in
a
l
X
P
C
A
da
ta
w
it
h r
e
le
va
nt
f
e
a
tu
r
e
s
a
nd l
ow
e
r
di
m
e
ns
io
na
li
ty
t
ha
n I
G
.
2
.
6
.
C
la
s
s
if
i
c
at
io
n
a
lg
or
it
h
m
T
he
s
ugg
e
s
te
d
d
e
te
c
ti
on
s
y
s
te
m
f
or
id
e
nt
if
yi
ng
D
D
oS
a
s
s
a
ul
ts
on
c
lo
ud
c
om
put
in
g
e
m
pl
oys
a
c
la
s
s
if
ic
a
ti
on
a
lg
or
it
hm
.
T
hr
e
e
c
la
s
s
if
ic
a
ti
on
te
c
hni
que
s
w
il
l
be
e
m
pl
oye
d:
RF
,
DT
,
a
nd
NB
.
T
hi
s
pr
opos
e
d
a
ppr
oa
c
h
a
im
s
to
f
in
d
th
e
be
s
t
m
e
th
od
to
d
e
te
c
t
D
D
oS
a
tt
a
c
ks
on
c
lo
ud
c
om
put
in
g
n
e
twor
ks
.
I
n
a
ddi
ti
on,
it
s
e
e
ks
a
n
opt
im
iz
a
ti
on
m
e
th
od
f
or
th
e
de
te
c
ti
on
s
ys
te
m
w
it
h
a
f
e
a
tu
r
e
s
e
le
c
ti
on
pr
oc
e
s
s
.
T
hi
s
s
tu
dy
pr
opos
e
s
th
r
e
e
f
e
a
tu
r
e
s
e
le
c
ti
on
s
c
he
m
e
s
:
I
G
,
P
C
A
,
a
nd
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on.
T
he
f
ol
lo
w
in
g
a
r
e
de
ta
il
s
a
bout
th
e
de
te
c
ti
on me
th
ods
us
e
d i
n t
hi
s
s
tu
dy.
i)
D
T
is
a
s
upe
r
vi
s
e
d
m
a
c
hi
ne
le
a
r
ni
ng
a
lg
or
it
hm
th
a
t
e
m
pl
o
ys
a
tr
e
e
s
tr
uc
tu
r
e
f
or
c
la
s
s
if
ic
a
ti
on
or
r
e
gr
e
s
s
io
n.
I
t
be
gi
n
s
a
t
th
e
r
oot
node
,
w
hi
c
h
s
ig
ni
f
ie
s
th
e
pr
im
a
r
y
f
e
a
tu
r
e
s
,
a
nd
r
e
c
ur
s
iv
e
ly
p
a
r
ti
ti
ons
th
e
da
ta
a
t
de
c
i
s
io
n
node
s
(
in
te
r
na
l
node
s
)
a
c
c
or
di
ng
to
s
pe
c
if
ic
c
r
it
e
r
ia
unt
il
it
a
r
r
iv
e
s
a
t
th
e
le
a
f
nod
e
s
,
w
hi
c
h
yi
e
ld
th
e
pr
e
di
c
te
d
out
c
om
e
s
.
T
hi
s
te
c
hni
que
id
e
nt
if
ie
s
th
e
m
os
t
e
f
f
e
c
ti
ve
f
e
a
tu
r
e
pa
r
ti
ti
on
to
pr
ovi
de
a
hom
oge
ne
ous
d
a
ta
s
ub
s
e
t,
he
n
c
e
pr
om
ot
in
g
tr
a
ns
pa
r
e
nt
a
nd
c
om
pr
e
he
ns
ib
le
de
c
is
io
n
-
m
a
ki
ng
[
23]
, [
24]
.
I
ts
a
dva
nt
a
ge
s
a
r
e
e
a
s
e
of
i
nt
e
r
pr
e
ta
ti
on a
nd vis
ua
li
z
a
ti
on of
r
e
s
ul
ts
.
ii)
R
F
is
a
n
e
ns
e
m
bl
e
m
a
c
hi
ne
le
a
r
ni
ng
a
lg
or
it
hm
th
a
t
ge
ne
r
a
te
s
a
f
in
a
l
pr
e
di
c
ti
on
ba
s
e
d
on
a
ve
r
a
g
e
(
f
or
r
e
gr
e
s
s
io
n)
or
m
a
jo
r
it
y voti
ng (
f
or
c
la
s
s
if
ic
a
ti
on)
a
f
te
r
a
ggr
e
ga
ti
ng pr
e
di
c
ti
ons
f
r
om
nume
r
ous
r
a
ndoml
y
bui
lt
DT
s
us
in
g
boot
s
tr
a
p
s
a
m
pl
in
g
te
c
hni
que
s
a
nd
r
a
ndom
f
e
a
tu
r
e
s
e
le
c
ti
on
a
t
e
a
c
h
node
[
25]
.
R
F
e
nha
nc
e
s
a
c
c
ur
a
c
y,
m
it
ig
a
te
s
ove
r
f
it
ti
ng,
a
nd
yi
e
ld
s
a
m
or
e
s
ta
bl
e
a
nd
d
e
pe
nda
bl
e
m
od
e
l
by
a
m
a
lg
a
m
a
ti
ng nume
r
ous
unc
or
r
e
la
te
d t
r
e
e
s
, i
n c
ont
r
a
s
t
to
a
s
ol
i
ta
r
y
DT
[
26]
.
iii)
N
B
is
a
pr
oba
bi
li
s
ti
c
-
ba
s
e
d
s
up
e
r
vi
s
e
d
le
a
r
ni
ng
a
lg
or
it
hm
th
a
t
us
e
s
B
a
y
e
s
'
th
e
or
e
m
,
a
s
s
um
in
g
th
a
t
f
e
a
tu
r
e
s
a
r
e
in
de
pe
nde
nt
(
in
de
pe
nde
nc
e
a
s
s
um
pt
io
n)
[
27]
.
T
hi
s
a
lg
or
it
hm
c
a
lc
ul
a
te
s
th
e
pos
te
r
io
r
pr
oba
bi
li
ty
of
e
a
c
h
c
la
s
s
by
a
na
ly
z
in
g
th
e
di
s
tr
ib
ut
io
n
of
in
put
da
ta
.
I
t
s
ubs
e
que
nt
ly
id
e
nt
if
ie
s
th
e
c
la
s
s
w
it
h
th
e
gr
e
a
te
s
t
pr
oba
bi
li
ty
a
s
th
e
de
f
in
it
iv
e
out
c
om
e
[
28]
.
N
B
is
known
f
or
it
s
s
im
pl
ic
it
y,
c
om
put
a
ti
ona
l
e
f
f
ic
ie
nc
y, a
nd good pe
r
f
or
m
a
nc
e
on l
a
r
ge
da
ta
s
e
ts
a
nd t
e
xt
c
la
s
s
if
ic
a
ti
on
.
2
.
6
.
E
xp
e
r
im
e
n
t
t
e
s
t
in
g
T
he
te
s
ti
ng
in
th
is
s
tu
dy
is
c
onduc
te
d
a
c
r
os
s
th
r
e
e
s
c
e
na
r
io
s
.
F
ir
s
t,
te
s
ti
ng
is
pe
r
f
or
m
e
d
us
in
g
a
s
pl
it
da
ta
s
e
t
to
bui
ld
th
e
m
ode
l.
S
e
c
ond,
te
s
ti
ng
is
c
onduc
te
d
w
it
h
5
-
f
ol
d
c
r
os
s
-
va
li
da
ti
on
.
F
in
a
ll
y,
te
s
ti
ng
w
it
h
10
-
f
ol
d c
r
os
s
-
va
li
da
ti
on i
s
us
e
d t
o c
ons
tr
uc
t
th
e
de
t
e
c
ti
on s
ys
t
e
m
m
ode
l.
2
.
7
.
A
n
al
ys
is
t
ool
s
T
hi
s
r
e
s
e
a
r
c
h
w
a
s
c
onduc
te
d
w
it
hi
n
a
c
lo
ud
c
om
put
in
g
e
nvi
r
onm
e
nt
,
m
a
ki
ng
us
e
of
pl
a
tf
or
m
s
s
uc
h
a
s
K
a
ggl
e
to
obt
a
in
a
nd
m
a
na
ge
da
t
a
s
e
t
s
,
pe
r
f
or
m
f
e
a
tu
r
e
s
e
le
c
ti
on,
a
nd
r
un
th
e
ove
r
a
ll
de
te
c
ti
on
s
ys
te
m
in
a
s
c
a
la
bl
e
m
a
nne
r
.
I
n
a
ddi
ti
on
to
c
lo
ud
r
e
s
our
c
e
s
,
va
r
io
us
c
o
m
put
a
ti
ona
l
to
ol
s
w
e
r
e
in
te
gr
a
te
d
to
e
n
s
ur
e
e
f
f
ic
ie
nc
y
a
nd
r
e
pr
oduc
ib
il
it
y
th
r
oughout
th
e
e
xpe
r
im
e
nt
s
.
T
he
s
c
ik
it
-
le
a
r
n
li
br
a
r
y
pl
a
ye
d
a
c
e
nt
r
a
l
r
ol
e
,
s
e
r
vi
ng
a
s
th
e
pr
im
a
r
y
f
r
a
m
e
w
or
k
f
or
im
pl
e
m
e
nt
in
g
bot
h
f
e
a
tu
r
e
s
e
le
c
ti
on
te
c
hni
qu
e
s
a
nd
d
e
te
c
ti
on
a
lg
or
it
hm
s
dur
in
g
th
e
c
om
put
a
ti
on
pr
oc
e
s
s
.
B
y
c
om
bi
ni
ng
c
lo
ud
-
ba
s
e
d
r
e
s
our
c
e
s
a
nd
m
a
c
hi
ne
le
a
r
ni
ng
li
br
a
r
ie
s
,
th
e
s
tu
dy
w
a
s
a
bl
e
to
s
tr
e
a
m
li
ne
d
a
ta
pr
oc
e
s
s
in
g,
e
nh
a
nc
e
de
te
c
ti
on
a
c
c
ur
a
c
y,
a
nd
s
uppor
t
f
le
xi
bl
e
e
xpe
r
im
e
nt
a
ti
on i
n di
f
f
e
r
e
nt
s
c
e
na
r
io
s
.
2
.
8
.
E
val
u
at
io
n
T
he
pe
r
f
or
m
a
nc
e
of
th
e
de
te
c
ti
on
s
ys
te
m
w
a
s
a
s
s
e
s
s
e
d
in
th
is
s
tu
dy
ut
il
iz
in
g
a
num
be
r
of
c
r
it
e
r
ia
,
in
c
lu
di
ng
a
c
c
ur
a
c
y,
pr
e
c
is
io
n,
tr
ue
po
s
it
iv
e
r
a
te
s
(
T
P
R
)
,
F
P
R
,
a
nd
r
e
c
e
iv
e
r
ope
r
a
ti
ng
c
ha
r
a
c
t
e
r
is
ti
c
(
R
O
C
)
s
T
he
e
qua
ti
on i
s
u
s
e
d t
o f
or
m
ul
a
te
th
is
m
e
a
s
ur
e
m
e
nt
a
r
e
s
how
n i
n
(
6)
to
(
9)
.
=
+
+
+
+
(
6)
=
+
(
7)
=
+
(
8)
=
+
(
9)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
A
r
ti
f
I
nt
e
ll
,
V
ol
. 14, No. 5, O
c
to
be
r
2025
:
3945
-
3957
3950
3.
R
E
S
U
L
T
S
A
N
D
D
I
S
C
U
S
S
I
O
N
T
he
r
e
s
e
a
r
c
h
f
in
di
ngs
a
nd
a
c
om
pr
e
he
ns
iv
e
di
s
c
u
s
s
io
n
a
r
e
pr
e
s
e
nt
e
d
in
th
is
s
e
c
ti
on.
T
he
r
e
s
ul
ts
a
r
e
il
lu
s
tr
a
te
d
w
it
h
f
ig
ur
e
s
a
nd
ta
bl
e
s
.
T
he
di
s
c
us
s
io
n
is
di
v
id
e
d
in
to
s
e
ve
r
a
l
s
ub
-
s
e
c
ti
on
s
to
f
a
c
il
it
a
te
c
om
pr
e
he
ns
io
n, i
nc
lu
di
ng t
he
r
e
s
ul
ts
of
t
he
I
G
, P
C
A
, a
nd t
w
o
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
.
3.1.
R
e
s
u
lt
of
in
f
or
m
at
io
n
gai
n
T
he
I
G
m
e
th
od
is
e
m
pl
oye
d
in
th
is
s
e
c
ti
on
to
id
e
nt
if
y
a
nd
f
il
te
r
r
e
le
va
nt
a
tt
r
ib
ut
e
s
f
or
th
e
de
te
c
ti
on
pr
oc
e
s
s
.
T
he
r
e
s
ul
t
s
of
f
e
a
tu
r
e
s
e
le
c
ti
on
a
r
e
out
li
ne
d
in
th
is
s
e
c
ti
on.
T
a
bl
e
2
pr
e
s
e
nt
s
th
e
out
c
om
e
s
of
f
e
a
tu
r
e
s
e
le
c
ti
on
a
na
ly
s
e
s
c
onduc
te
d
us
in
g
th
e
I
G
a
ppr
oa
c
h.
T
he
c
o
m
put
a
ti
on
pr
oduc
e
s
th
e
w
e
ig
ht
va
lu
e
f
or
e
a
c
h
f
e
a
tu
r
e
.
A
r
a
nki
ng
is
c
onduc
te
d
f
or
e
a
c
h
f
e
a
tu
r
e
w
e
ig
ht
to
d
e
te
r
m
in
e
th
os
e
w
it
h
th
e
hi
ghe
s
t
s
ig
ni
f
ic
a
nc
e
,
w
hi
c
h
w
il
l
s
ubs
e
que
nt
ly
be
e
m
pl
oye
d
a
s
de
te
c
ti
on
f
e
a
tu
r
e
s
.
T
hi
s
s
tu
dy
id
e
nt
if
ie
d
th
e
to
p
10
f
e
a
tu
r
e
s
a
c
c
or
di
ng t
o t
he
ir
w
e
ig
ht
va
lu
e
s
, w
hi
c
h w
oul
d be
e
m
pl
oye
d i
n t
he
de
te
c
ti
on pr
oc
e
s
s
.
T
a
bl
e
2
.
T
he
p
er
f
or
m
a
nc
e
of
IG
N
o
N
um
be
r
of
f
e
a
t
ur
e
s
N
a
m
e
of
f
e
a
t
ur
e
s
W
e
i
ght
N
o
N
um
be
r
of
f
e
a
t
ur
e
s
N
a
m
e
of
f
e
a
t
ur
e
s
W
e
i
ght
1
39
I
A
T
2.110198
24
9
r
s
t
_f
l
a
g_num
be
r
0.348559
2
1
H
e
a
de
r
_L
e
ngt
h
1.210035
25
10
ps
h_f
l
a
g_num
be
r
0.345456
3
38
T
ot
s
i
z
e
1.129592
26
37
S
t
d
0.325441
4
41
M
a
gni
t
ue
1.118270
27
42
R
a
di
us
0.322530
5
34
M
i
n
1.116962
28
43
C
ova
r
i
a
nc
e
0.317749
6
36
AVG
1.110629
29
44
V
a
r
i
a
nc
e
0.268860
7
33
T
ot
s
um
1.101664
30
3
D
ur
a
t
i
on
0.169837
8
35
M
a
x
1.061710
31
40
N
um
be
r
0.150890
9
2
P
r
ot
oc
ol
T
ype
1.026949
32
45
W
e
i
ght
0.148681
10
15
s
yn_c
ount
0.658792
33
20
H
T
T
P
S
0.066578
11
26
T
C
P
0.658677
34
19
H
T
T
P
0.032225
12
4
R
a
t
e
0.577531
35
31
I
P
v
0.015481
13
5
S
r
a
t
e
0.577285
36
32
LLC
0.012103
14
0
f
l
ow
_dur
a
t
i
on
0.572258
37
24
SSH
0.002293
15
18
r
s
t
_c
ount
0.547138
38
13
c
w
r
_f
l
a
g_num
be
r
0.001538
16
30
I
C
M
P
0.533837
39
29
A
R
P
0.000983
17
8
s
yn_f
l
a
g_num
be
r
0.524269
40
6
D
r
a
t
e
0.000846
18
17
ur
g_c
ount
0.501401
41
22
T
e
l
ne
t
0.000243
19
27
UDP
0.424965
42
28
D
H
C
P
0.000155
20
16
f
i
n_c
ount
0.393286
43
12
e
c
e
_f
l
a
g_num
be
r
0.000000
21
14
a
c
k_c
ount
0.386183
44
23
S
M
T
P
0.000000
22
11
a
c
k_f
l
a
g_num
be
r
0.379289
45
21
DNS
0.000000
23
7
f
i
n_f
l
a
g_num
be
r
0.358502
46
25
I
R
C
0.000000
3.2.
R
e
s
u
lt
of
p
r
in
c
ip
al
c
om
p
on
e
n
t
an
al
ys
is
P
C
A
is
a
f
e
a
tu
r
e
r
e
duc
ti
on
te
c
hni
que
th
a
t
tr
a
ns
f
or
m
s
e
xi
s
ti
ng
f
e
a
tu
r
e
s
in
to
ne
w
f
e
a
tu
r
e
r
e
pr
e
s
e
nt
a
ti
ons
. T
a
bl
e
3 i
s
a
n i
ns
ta
nc
e
of
us
e
P
C
A
t
o de
c
r
e
a
s
e
t
he
t
ot
a
l
a
m
ount
of
f
e
a
tu
r
e
s
f
r
om
47 t
o
10. T
he
ne
w
f
e
a
tu
r
e
tr
a
ns
f
or
m
s
th
e
P
C
A
f
in
di
ngs
in
to
a
r
a
nki
ng
di
s
ti
n
c
t
f
r
om
th
e
o
r
ig
in
a
l
da
ta
va
lu
e
s
.
T
he
va
lu
e
is
ty
pi
c
a
ll
y nor
m
a
li
z
e
d t
o a
r
a
nge
of
-
1 t
o 1.
T
a
bl
e
3
.
T
he
p
er
f
or
m
a
nc
e
of
P
C
A
V
a
l
ue
P
C
A
R
ow
1
R
ow
2
R
ow
3
R
ow
4
R
ow
5
P
C
A
0
8675.561
-
152738
-
91943.8
120524.6
76580.89
P
C
A
1
214703.8
-
45951.4
-
46090.3
-
46399.4
-
46347.1
P
C
A
2
185975.4
15616.08
15599.35
15322.46
15397.55
P
C
A
3
-
12003.9
-
11986.8
-
12196.8
-
12200.9
-
12117.9
P
A
C
4
-
8565.2
251.7574
384.5478
264.1639
262.6733
P
C
A
5
78.792
10.08704
3.635533
12.25255
12.24731
P
C
A
6
141.9468
-
1.47545
-
5.98376
0.179532
-
0.14366
P
C
A
7
25.50638
0.135234
1.243965
0.297605
1.526457
P
C
A
8
64.84385
4.058592
-
4.96672
4.492461
4.835289
P
C
A
9
86.19377
-
3.56293
1.823169
-
2.8915
-
2.83645
3.
3
.
R
e
s
u
lt
of
t
w
o
-
s
t
e
p
f
e
at
u
r
e
s
e
le
c
t
io
n
T
hi
s
s
e
c
ti
on
di
s
c
u
s
s
e
s
th
e
r
e
s
ul
ts
of
th
e
pr
opos
e
d
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
od.
T
he
y
a
r
e
na
m
e
d
tw
o
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
.
T
h
e
pr
oc
e
s
s
is
to
do
two
f
e
a
tu
r
e
s
e
le
c
ti
on
pr
oc
e
s
s
e
s
.
F
ir
s
t,
th
e
f
e
a
tu
r
e
i
s
done
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
A
r
ti
f
I
nt
e
ll
I
S
S
N
:
2252
-
8938
T
w
o
-
s
te
ps
f
e
at
ur
e
s
e
le
c
ti
on f
or
de
te
c
ti
on v
a
r
ia
nt
di
s
tr
ib
ut
e
d de
ni
al
of
s
e
r
v
ic
e
s
at
ta
c
k
…
(
K
ur
ni
abudi)
3951
us
in
g
I
G
.
T
he
n,
th
e
f
e
a
tu
r
e
s
e
le
c
ti
on
r
e
s
ul
ts
w
it
h
I
G
a
r
e
us
e
d
a
s
in
put
f
or
th
e
P
C
A
m
e
th
od.
T
he
pr
oc
e
s
s
f
lo
w
of
t
he
47 f
e
a
tu
r
e
s
i
s
s
e
le
c
te
d i
nt
o t
e
n f
e
a
tu
r
e
s
, t
he
n e
xt
r
a
c
te
d us
in
g P
C
A
i
nt
o e
ig
ht
f
e
a
tu
r
e
s
, a
s
i
n T
a
bl
e
4.
T
a
bl
e
4
.
T
he
p
er
f
or
m
a
nc
e
of
to
w
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
V
a
l
ue
P
C
A
R
ow
1
R
ow
2
R
ow
3
R
ow
4
R
ow
5
P
C
A
0
8131.762
-
152680
-
91885.5
120583.3
76639.5
P
C
A
1
-
38307.9
-
38261.8
-
38324.9
-
38262
-
38295.8
P
C
A
2
9447.373
-
306.421
-
439.521
-
320.543
-
318.748
P
C
A
3
-
419.262
-
2.66787
7.760183
-
4.66937
-
4.73017
P
C
A
4
-
148.211
3.106256
7.680614
1.901873
2.096895
P
C
A
5
91.9793
1.496252
-
3.67944
2.103574
2.043199
P
C
A
6
-
9.01527
-
1.68345
3.461927
-
1.30394
-
1.33527
P
C
A
7
5.819091
0.77438
5.699311
0.73147
0.714889
3.
4
.
R
e
s
u
lt
of
at
t
ac
k
d
e
t
e
c
t
io
n
T
he
ne
xt
s
ta
ge
is
to
c
onduc
t
th
e
de
te
c
ti
on
pr
oc
e
s
s
to
obt
a
in
a
r
e
li
a
bl
e
de
te
c
ti
on
s
ys
te
m
m
ode
l
f
or
de
te
c
ti
ng
D
D
oS
a
tt
a
c
k
s
in
c
lo
ud
c
om
put
in
g.
T
he
m
ode
l
te
s
ti
n
g
us
e
d
in
th
i
s
s
tu
dy
is
D
T
,
R
F
,
a
nd
N
B
.
E
a
c
h
m
ode
l
is
pr
e
s
e
nt
e
d
w
it
h
th
r
e
e
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
od
s
,
na
m
e
ly
I
G
,
P
C
A
,
a
nd
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
.
T
he
n,
th
e
e
va
lu
a
ti
on
pa
r
a
m
e
te
r
s
us
e
d
a
r
e
a
c
c
ur
a
c
y,
pr
e
c
is
io
n,
T
P
R
,
F
P
R
a
nd
R
O
C
.
A
ddi
ti
ona
ll
y,
m
ode
l
va
li
da
ti
on w
a
s
c
onduc
te
d u
s
in
g da
ta
s
pl
it
ti
ng, 5
-
f
ol
d c
r
os
s
-
va
li
da
ti
on, a
nd 10
-
f
ol
d c
r
os
s
-
va
li
da
ti
on.
F
i
gu
r
e
2
is
one
o
f
th
e
r
e
s
u
lt
s
o
f
te
s
ti
n
g
th
e
R
F
m
o
de
l
us
in
g
t
w
o
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
(IG
-
P
C
A
)
.
W
he
r
e
th
is
is
th
e
va
lu
e
of
t
he
c
on
f
us
io
n
m
a
tr
ix
o
r
th
e
nu
m
b
e
r
o
f
s
uc
c
e
s
s
e
s
o
f
e
a
c
h
t
ype
o
f
D
D
oS
a
t
ta
c
k
s
uc
c
e
s
s
f
ul
ly
de
te
c
te
d
,
th
e
r
e
a
r
e
s
t
i
ll
s
om
e
d
e
te
c
ti
on
e
r
r
or
s
,
b
ut
th
e
y
c
a
n
be
to
le
r
a
te
d.
U
ns
uc
c
e
s
s
f
ul
te
s
ti
ng
w
a
s
ob
ta
in
e
d
us
in
g
t
he
N
B
m
e
th
od
,
w
he
r
e
m
a
ny
de
te
c
ti
o
n
e
r
r
or
s
oc
c
ur
r
e
d.
F
ig
u
r
e
3
is
a
n
e
x
a
m
p
le
of
o
ne
o
f
th
e
te
s
ts
w
it
h
th
e
N
B
m
e
t
ho
d.
T
he
r
e
s
ul
ts
s
ho
w
de
te
c
t
io
n
e
r
r
o
r
s
t
ha
t
a
r
e
a
l
m
os
t
a
l
l
de
t
e
c
te
d
a
s
D
D
oD
-
T
C
P
_
F
l
ood
a
t
ta
c
ks
.
F
ig
ur
e
2
.
R
e
s
ul
t
of
RF
c
onf
us
io
n m
a
tr
ix
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
A
r
ti
f
I
nt
e
ll
,
V
ol
. 14, No. 5, O
c
to
be
r
2025
:
3945
-
3957
3952
F
ig
ur
e
3
.
R
e
s
ul
t
of
NB
c
onf
us
io
n m
a
tr
ix
T
he
n
e
xt
s
t
e
p
is
to
c
a
lc
ul
a
te
th
e
pe
r
f
or
m
a
nc
e
of
e
a
c
h
te
s
t
m
ode
l
us
in
g
v
a
r
io
us
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
ods
.
T
a
bl
e
5
s
how
s
th
e
r
e
s
ul
ts
of
D
D
oS
a
tt
a
c
k
de
te
c
ti
on
on
c
lo
ud
c
om
put
in
g
ne
twor
ks
us
in
g
th
e
R
F
a
lg
or
it
hm
a
nd
th
e
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
od.
T
he
m
e
tr
ic
s
us
e
d
f
or
e
va
lu
a
ti
on
in
c
lu
de
a
c
c
ur
a
c
y,
pr
e
c
is
io
n,
T
P
R
,
F
P
R
,
a
nd
R
O
C
.
T
he
s
e
r
e
s
ul
ts
s
how
ve
r
y
g
ood
pe
r
f
or
m
a
nc
e
f
or
va
r
io
us
ty
pe
s
of
D
D
oS
a
tt
a
c
ks
, w
it
h a
s
uc
c
e
s
s
r
a
te
of
99
%
.
H
ow
e
ve
r
, f
or
t
he
D
D
oS
-
S
l
ow
L
or
is
a
tt
a
c
k, t
he
r
e
s
ul
ts
a
r
e
l
e
s
s
s
a
ti
s
f
a
c
to
r
y
w
it
h a
n a
c
c
ur
a
c
y of
a
r
ound 85
%
.
T
a
bl
e
5
.
R
e
s
ul
t
of
d
e
te
c
ti
on D
D
oS
a
tt
a
c
k u
s
in
g I
G
-
P
C
A
(
two
-
s
t
e
p
f
e
a
tu
r
e
s
e
le
c
ti
on
)
T
ype
s
of
a
t
t
a
c
k
RF
-
IG
-
P
C
A
A
c
c
ur
a
c
y
P
r
e
c
i
s
i
on
R
e
c
a
l
l
T
P
R
FPR
R
O
C
B
e
ni
gnT
r
a
f
f
i
c
0.994
1.000
0.999
1.000
0
1.000
D
D
oS
-
A
C
K
_F
r
a
gm
e
nt
a
t
i
on
0.990
0.996
1.000
0.982
0
0.991
D
D
oS
-
H
T
T
P
_
F
l
ood
0.878
1.000
1.000
0.95
0
0.975
D
D
oS
-
I
C
M
P
_F
l
ood
0.999
1.000
1.000
1.000
0
1.000
D
D
oS
-
I
C
M
P
_F
r
a
gm
e
nt
a
t
i
on
0.989
0.997
0.997
0.996
0
0.998
D
D
oS
-
P
S
H
A
C
K
_F
l
ood
0.997
0.999
0.999
0.998
0
0.999
D
D
oS
-
R
S
T
F
I
N
F
l
ood
0.998
0.999
0.999
0.999
0
0.999
D
D
oS
-
S
Y
N
_F
l
ood
0.998
0.999
0.999
0.999
0
1.000
D
D
oS
-
S
l
ow
L
or
i
s
0.855
1.000
1.000
0.94
0
0.97
D
D
oS
-
S
ynonym
ous
I
P
_F
l
ood
0.997
1.000
0.999
0.999
0
0.999
D
D
oS
-
T
C
P
_F
l
ood
0.999
0.999
0.999
1.000
0
1.000
D
D
oS
-
U
D
P
_F
l
ood
0.999
0.999
1.000
1.000
0
1.000
D
D
oS
-
U
D
P
_F
r
a
gm
e
nt
a
t
i
on
0.983
1.000
1.000
0.993
0
0.997
T
he
n,
th
e
a
ve
r
a
ge
r
e
s
ul
ts
of
e
a
c
h
m
ode
l
te
s
t
a
nd
f
e
a
tu
r
e
s
e
le
c
ti
on
th
a
t
ha
s
be
e
n
done
a
r
e
c
a
lc
ul
a
te
d
in
T
a
bl
e
6.
T
hi
s
ta
bl
e
c
om
pa
r
e
s
e
a
c
h
m
ode
l
w
it
h
e
a
c
h
f
e
a
t
ur
e
s
e
le
c
ti
on
m
e
th
od.
T
he
be
s
t
r
e
s
ul
ts
w
e
r
e
obt
a
in
e
d
f
r
om
th
e
R
F
m
e
th
od
f
or
a
ll
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
od
s
in
s
pl
it
da
ta
.
T
he
two
be
s
t
r
e
s
ul
ts
w
e
r
e
a
ls
o
obt
a
in
e
d f
r
om
t
he
D
T
m
e
th
od w
it
h a
ll
f
e
a
tu
r
e
s
e
le
c
ti
on me
th
od
s
. H
ow
e
ve
r
, t
he
oppos
it
e
r
e
s
ul
t
oc
c
ur
r
e
d i
n t
he
N
B
m
e
th
od,
w
hi
c
h
f
a
il
e
d
to
de
te
c
t
D
D
oS
a
tt
a
c
ks
on
c
lo
u
d
c
om
put
in
g
ne
twor
ks
,
w
hi
c
h
onl
y
r
e
a
c
he
d
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
A
r
ti
f
I
nt
e
ll
I
S
S
N
:
2252
-
8938
T
w
o
-
s
te
ps
f
e
at
ur
e
s
e
le
c
ti
on f
or
de
te
c
ti
on v
a
r
ia
nt
di
s
tr
ib
ut
e
d de
ni
al
of
s
e
r
v
ic
e
s
at
ta
c
k
…
(
K
ur
ni
abudi)
3953
30
to
40
%
.
T
he
r
e
s
ul
ts
of
th
e
T
P
R
a
nd
F
P
R
pa
r
a
m
e
t
e
r
s
f
or
D
T
a
nd
F
R
in
di
c
a
te
th
a
t
th
e
s
e
m
ode
ls
a
r
e
c
a
pa
bl
e
of
e
f
f
e
c
ti
ve
ly
de
te
c
ti
ng D
D
oS
a
tt
a
c
ks
.
T
a
bl
e
6
.
R
e
s
ul
t
of
va
li
da
ti
on mode
l
de
te
c
ti
on
D
D
oS
a
tt
a
c
k i
n
d
a
ta
s
pl
it
M
ode
l
F
e
a
t
ur
e
s
e
l
e
c
t
i
on
T
P
R
FPR
P
r
e
c
i
s
i
on
R
O
C
A
c
c
ur
a
c
y
DT
IG
0.999
0
0.999
0.999
0.999
P
C
A
0.983
0
0.987
0.991
0.998
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.999
0
0.999
0.999
0.999
RF
IG
0.993
0
0.990
0.996
0.999
P
C
A
0.98
0
0.992
0.989
0.998
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.988
0
0.986
0.994
0.998
NB
IG
0.394
0.059
0.375
0.667
0.321
P
C
A
0.403
0.059
0.401
0.671
0.322
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.398
0.059
0.349
0.669
0.320
I
n
T
a
bl
e
s
7
a
nd
8
,
th
e
r
e
s
ul
t
s
of
th
e
D
D
oS
de
t
e
c
t
io
n
s
y
s
te
m
m
ode
l
v
a
li
d
a
ti
on
t
e
s
ti
ng
u
s
in
g
5
-
f
ol
d
c
r
os
s
-
va
li
da
ti
on a
nd
10
-
f
ol
d c
r
o
s
s
-
va
li
da
ti
o
n a
r
e
pr
e
s
e
nt
e
d.
T
he
r
e
s
ul
t
s
s
how
t
h
a
t
e
a
c
h m
e
a
s
ur
e
m
e
nt
p
a
r
a
m
e
te
r
e
xhi
bi
t
s
s
a
ti
s
f
a
c
to
r
y
v
a
lu
e
s
.
N
ot
a
bl
y,
a
s
ig
ni
f
i
c
a
nt
im
pr
ov
e
m
e
nt
i
s
ob
s
e
r
v
e
d
in
th
e
N
B
m
ode
l,
w
h
e
r
e
th
e
a
c
c
ur
a
c
y
r
e
a
c
h
e
d
onl
y
30
%
in
th
e
da
t
a
s
pl
i
t
m
o
de
l.
I
n
t
he
c
r
os
s
-
va
li
d
a
ti
on
te
s
t
s
,
th
e
a
c
c
ur
a
c
y
in
c
r
e
a
s
e
d
to
89
%
. T
hi
s
i
ndi
c
a
t
e
s
t
ha
t
th
e
N
B
m
ode
l
r
e
qui
r
e
s
t
he
us
e
of
c
r
os
s
-
va
li
da
ti
on f
or
i
ts
t
r
a
in
in
g pr
o
c
e
s
s
.
T
a
bl
e
7
.
R
e
s
ul
t
of
va
li
da
ti
on mode
l
de
te
c
ti
on
D
D
oS
a
tt
a
c
k i
n
5
-
c
r
os
s
va
li
da
ti
on
M
ode
l
F
e
a
t
ur
e
s
e
l
e
c
t
i
on
T
P
R
FPR
P
r
e
c
i
s
i
on
R
O
C
A
c
c
ur
a
c
y
DT
IG
0.999
0
0.999
0.999
0.999
P
C
A
0.99
0
0
0.991
0.995
0.999
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.998
0
0.997
0.999
0.999
RF
IG
0.993
0
0.989
0.996
0.999
P
C
A
0.984
0
0.985
0.992
0.999
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.988
0
0.987
0.994
0.999
NB
IG
0.396
0.06
0.383
0.668
0.893
P
C
A
0.406
0.059
0.411
0.673
0.894
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.398
0.06
0.366
0.669
0.893
T
a
bl
e
8
.
R
e
s
ul
t
of
va
li
da
ti
on mode
l
de
te
c
ti
on
D
D
oS
a
tt
a
c
k i
n
10
-
c
r
os
s
va
li
da
ti
on
M
ode
l
F
e
a
t
ur
e
s
e
l
e
c
t
i
on
T
P
R
FPR
P
r
e
c
i
s
i
on
R
O
C
A
c
c
ur
a
c
y
DT
IG
0.999
0
0.999
0.999
0.999
P
C
A
0.991
0
0.991
0.995
0.999
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.998
0
0.998
0.999
0.999
RF
IG
0.993
0
0.991
0.996
0.999
P
C
A
0.988
0
0.988
0.993
0.999
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.99
0
0.988
0.994
0.999
NB
IG
0.396
0.06
0.39
0.668
0.893
P
C
A
0.406
0.059
0.41
0.673
0.894
T
w
o
-
s
t
e
p
f
e
a
t
ur
e
s
e
l
e
c
t
i
on
0.399
0.06
0.367
0.669
0.893
3.
5
.
D
is
c
u
s
s
io
n
s
T
hi
s
s
e
c
ti
on
de
li
ne
a
te
s
th
e
r
e
s
ul
ts
of
th
e
c
onduc
t
e
d
e
xpe
r
im
e
nt
s
.
T
hi
s
r
e
s
e
a
r
c
h
a
im
s
to
de
ve
lo
p
a
de
te
c
ti
on
s
ys
te
m
m
od
e
l
th
a
t
c
a
n
id
e
nt
if
y
th
e
va
r
io
us
f
or
m
s
of
D
D
oS
a
tt
a
c
ks
th
a
t
oc
c
ur
on
c
lo
ud
c
om
put
in
g
ne
twor
ks
.
T
he
pr
opos
e
d
de
te
c
ti
on
m
e
th
ods
a
r
e
D
T
,
R
F
,
a
nd
N
B
;
th
e
r
e
a
r
e
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
th
ods
,
na
m
e
ly
I
G
,
P
C
A
,
a
nd
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
.
T
he
te
s
t
r
e
s
ul
ts
a
r
e
s
u
pe
r
io
r
to
ot
he
r
m
e
th
ods
,
na
m
e
ly
R
F
,
D
T
,
a
nd
N
B
.
T
hi
s
ha
ppe
n
s
be
c
a
us
e
R
F
ha
s
s
upe
r
io
r
c
ha
r
a
c
te
r
is
ti
c
s
r
e
ga
r
di
ng
it
s
num
be
r
of
c
a
lc
ul
a
ti
ons
.
F
R
is
a
c
ol
le
c
ti
on of
s
e
ve
r
a
l
D
T
m
e
th
ods
s
o t
ha
t
it
c
a
n r
e
c
ogni
z
e
D
D
oS
a
tt
a
c
ks
be
tt
e
r
t
ha
n ot
he
r
m
e
th
ods
.
T
he
D
T
m
e
th
od
c
a
n
r
e
c
ogni
z
e
D
D
oS
a
tt
a
c
ks
w
e
ll
,
w
it
h
a
pe
r
c
e
nt
a
ge
r
e
a
c
hi
ng
99
%
.
T
h
e
oppos
it
e
oc
c
ur
s
in
th
e
N
B
m
e
th
od,
w
hi
c
h
c
a
n
be
c
onc
lu
de
d
to
f
a
il
to
r
e
c
ogni
z
e
D
D
oS
a
tt
a
c
ks
on
c
lo
ud
c
om
put
in
g
ne
twor
ks
.
T
hi
s
r
e
s
ul
t
is
l
ik
e
ly
due
t
o t
he
s
ta
ti
s
ti
c
a
l
c
ha
r
a
c
te
r
is
ti
c
s
of
t
he
N
B
m
e
th
od
,
w
hi
c
h i
s
l
e
s
s
s
ui
ta
bl
e
f
or
D
D
oS
a
tt
a
c
k
d
e
te
c
ti
on
m
ode
l
s
.
F
ig
ur
e
4 s
how
s
a
c
om
p
a
r
is
on
o
f
th
r
e
e
e
va
lu
a
ti
on
p
a
r
a
m
e
te
r
s
,
na
m
e
ly
:
i
)
T
P
R
,
ii
)
F
P
R
,
iii
)
pr
e
c
is
io
n
,
iv
)
R
O
C
,
a
nd
v
)
a
c
c
ur
a
c
y
.
O
f
a
ll
t
he
s
e
pa
r
a
m
e
te
r
s
,
onl
y
N
B
s
how
s
le
s
s
th
a
n
s
a
ti
s
f
a
c
to
r
y pe
r
f
or
m
a
nc
e
.
I
n
F
i
gu
r
e
4
(
a
)
,
t
he
c
o
m
p
a
r
is
o
n
of
th
e
pr
op
or
ti
on
o
f
tr
ue
pos
i
ti
ve
s
de
te
c
te
d
b
y
t
he
m
ode
l
is
pr
e
s
e
nt
e
d.
T
he
r
e
s
ul
ts
in
d
ic
a
te
th
a
t
th
e
R
F
m
ode
l
out
pe
r
f
o
r
m
s
t
he
N
B
m
od
e
l.
T
he
n,
in
F
ig
ur
e
4
(
b
)
,
t
he
F
P
R
p
a
r
a
m
e
te
r
s
how
s
t
he
p
r
o
po
r
t
io
n
of
ne
ga
ti
v
e
s
in
c
or
r
e
c
t
ly
de
te
c
t
e
d
a
s
pos
it
iv
e
s
b
y
th
e
m
od
e
l
.
T
h
e
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
A
r
ti
f
I
nt
e
ll
,
V
ol
. 14, No. 5, O
c
to
be
r
2025
:
3945
-
3957
3954
r
e
s
u
lt
s
de
m
o
ns
t
r
a
t
e
s
a
ti
s
f
a
c
to
r
y
pe
r
f
o
r
m
a
nc
e
a
c
r
os
s
a
l
l
m
o
de
l
s
.
P
r
e
c
is
io
n
is
de
pi
c
te
d
i
n
F
ig
u
r
e
4
(
c
)
,
w
h
ic
h
qua
n
ti
f
ie
s
t
he
r
a
t
io
o
f
ge
nui
ne
pos
i
ti
ve
pr
e
di
c
ti
ons
to
th
e
to
ta
l
nu
m
be
r
o
f
pos
i
t
iv
e
pr
e
di
c
t
io
ns
.
T
he
pr
e
c
is
i
on
f
in
di
ngs
p
r
o
vi
d
e
e
nha
nc
e
d
m
ode
l
e
va
lu
a
ti
on
f
or
t
he
D
T
a
n
d N
B
m
ode
ls
.
N
e
xt
,
in
F
ig
ur
e
4
(
d
)
,
th
e
R
O
C
va
l
ue
s
a
r
e
di
s
p
la
ye
d,
il
lu
s
tr
a
t
in
g
th
e
r
e
la
ti
ons
hi
p
be
t
w
e
e
n
T
P
R
a
nd
F
P
R
,
w
h
e
r
e
a
R
O
C
v
a
l
ue
a
bo
ve
0.5
is
c
ons
id
e
r
e
d
s
uc
c
e
s
s
f
ul
.
I
n
th
is
s
tu
dy,
t
he
R
O
C
pe
r
f
o
r
m
a
nc
e
is
v
e
r
y
s
a
ti
s
f
a
c
to
r
y
,
e
xc
e
p
t
f
o
r
th
e
N
B
m
ode
l.
F
ig
u
r
e
4(
e
)
i
ll
us
t
r
a
t
e
s
t
he
a
c
c
u
r
a
c
y,
i
ndi
c
a
t
in
g
h
ig
hl
y
s
a
t
is
f
a
c
t
o
r
y
pe
r
f
o
r
m
a
nc
e
,
w
it
h
a
c
c
u
r
a
c
y
e
nha
nc
e
m
e
nt
o
bs
e
r
ve
d
t
h
r
ou
gh
out
m
ode
l
va
l
id
a
t
io
n
us
in
g
c
r
os
s
-
va
l
id
a
t
io
n
.
C
ons
e
que
nt
ly
,
i
t
c
a
n
be
in
f
e
r
r
e
d
t
ha
t
th
e
im
pl
e
m
e
n
ta
t
io
n
o
f
c
r
os
s
-
va
li
da
t
io
n
c
a
n
im
p
r
ove
t
he
e
f
f
ic
a
c
y
o
f
t
he
de
te
c
ti
o
n
s
ys
te
m
w
he
n
in
t
e
g
r
a
t
e
d
w
i
th
f
e
a
tu
r
e
s
e
le
c
ti
on
.
F
r
o
m
th
e
te
s
t
r
e
s
u
lt
s
,
it
c
a
n
be
c
o
nc
l
ude
d
th
a
t
th
e
f
e
a
tu
r
e
s
e
l
e
c
t
io
n
m
e
t
hod
s
uc
c
e
s
s
f
ul
ly
im
p
r
ov
e
s
t
he
pe
r
f
or
m
a
n
c
e
of
t
he
D
D
oS
a
t
ta
c
k
va
r
i
a
t
io
n
de
te
c
ti
on
s
ys
te
m
us
i
ng
m
a
c
h
in
e
le
a
r
ni
n
g.
I
n
a
d
di
ti
on
,
t
he
two
-
s
te
p
f
e
a
tu
r
e
s
e
le
c
ti
on
m
e
t
ho
d
is
a
ls
o
s
u
c
c
e
s
s
f
ul
i
n
i
m
p
r
o
vi
ng
a
nd
de
te
c
ti
ng
D
D
o
S
a
t
ta
c
ks
o
n
c
l
oud
c
om
pu
ti
ng
ne
two
r
ks
.
T
he
n,
th
e
de
t
e
c
t
io
n
m
o
de
l
w
it
h
R
F
a
nd
D
T
c
a
n
r
e
c
o
gn
iz
e
s
e
ve
r
a
l
t
ype
s
o
f
D
D
o
S
a
tt
a
c
ks
be
tt
e
r
th
a
n
th
e
N
B
d
e
te
c
t
io
n
m
o
de
l
.
(
a
)
(
b)
(
c
)
(
d)
(
e
)
F
ig
ur
e
4
.
P
e
r
f
or
m
a
nc
e
of
de
te
c
ti
on D
D
oS
a
tt
a
c
k (
a
)
T
P
R
, (
b)
F
P
R
, (
c
)
p
r
e
c
is
io
n, (
d)
R
O
C
,
a
nd
(
e
)
a
c
c
ur
a
c
y
Evaluation Warning : The document was created with Spire.PDF for Python.