I
nte
rna
t
io
na
l J
o
urna
l o
f
E
lect
rica
l a
nd
Co
m
pu
t
er
E
ng
ineering
(
I
J
E
CE
)
Vo
l.
15
,
No
.
6
,
Decem
b
er
20
25
,
p
p
.
5
4
8
4
~
5
4
9
6
I
SS
N:
2088
-
8
7
0
8
,
DOI
: 1
0
.
1
1
5
9
1
/ijece.
v
15
i
6
.
pp
5
4
8
4
-
5
4
9
6
5484
J
o
ur
na
l ho
m
ep
a
g
e
:
h
ttp
:
//ij
ec
e.
ia
esco
r
e.
co
m
Flow
-
g
uided
lo
ng
sho
rt
-
ter
m memo
ry
with
a
da
p
tive
directiona
l
lea
rning
f
o
r robu
st
distri
buted
den
ia
l of servi
ce
a
t
tack det
ection
in
so
ft
wa
re
-
defi
n
ed net
wo
rking
H
ud
a
M
o
ha
m
m
ed
I
ba
di,
As
g
ha
r
A.
Asg
ha
ria
n Sa
rdro
ud
D
e
p
a
r
t
me
n
t
o
f
El
e
c
t
r
i
c
a
l
a
n
d
C
o
mp
u
t
e
r
En
g
i
n
e
e
r
i
n
g
,
U
r
m
i
a
U
n
i
v
e
r
s
i
t
y
,
U
r
mi
a
,
I
r
a
n
Art
icle
I
nfo
AB
S
T
RAC
T
A
r
ticle
his
to
r
y:
R
ec
eiv
ed
Ma
r
1
4
,
2
0
2
5
R
ev
is
ed
J
u
l 2
7
,
2
0
2
5
Acc
ep
ted
Sep
1
6
,
2
0
2
5
A
so
ftwa
re
-
d
e
fin
e
d
n
e
two
rk
in
g
(
S
DN
)
a
rc
h
it
e
c
tu
re
is
d
e
sig
n
e
d
to
imp
r
o
v
e
n
e
two
rk
a
g
il
it
y
b
y
d
e
c
o
u
p
li
n
g
th
e
c
o
n
tro
l
a
n
d
d
a
ta
p
lan
e
s,
b
u
t
w
h
il
e
m
u
c
h
m
o
re
flex
ib
le,
a
lso
m
a
k
e
s
n
e
tw
o
rk
s
m
o
re
v
u
ln
e
ra
b
le
t
o
t
h
re
a
ts,
su
c
h
a
s
d
istri
b
u
ted
d
e
n
ial
o
f
se
rv
ice
(DD
o
S
)
a
tt
a
c
k
s.
I
n
t
h
is
st
u
d
y
we
p
re
s
e
n
t
a
n
o
v
e
l
d
e
tec
ti
o
n
m
o
d
e
l,
th
e
flo
w
-
g
u
i
d
e
d
lo
n
g
sh
o
rt
-
term
m
e
m
o
ry
(LS
TM
)
n
e
two
rk
with
a
d
a
p
ti
v
e
d
irec
ti
o
n
a
l
lea
rn
in
g
(AD
L),
f
o
r
th
e
m
it
i
g
a
ti
o
n
o
f
DD
o
S
a
tt
a
c
k
s
in
so
ftwa
re
d
e
fin
e
d
n
e
two
r
k
in
g
(S
DN
)
e
n
v
ir
o
n
m
e
n
ts.
W
h
il
e
th
e
m
e
th
o
d
o
lo
g
y
is
b
a
se
d
o
n
a
fl
o
w
d
irec
ti
o
n
a
lg
o
rit
h
m
(F
DA
),
w
h
ich
a
n
a
ly
z
e
s
traffic
p
a
tt
e
rn
s
a
n
d
d
e
tec
ts
a
n
o
m
a
li
e
s
fro
m
d
irec
ti
o
n
a
l
f
lo
w
b
e
h
a
v
io
r
.
T
h
e
p
ro
p
o
se
d
m
e
th
o
d
i
n
teg
ra
tes
F
DA
in
LS
T
M
-
b
a
se
d
t
h
re
a
t
d
e
tec
ti
o
n
fra
m
e
wo
rk
s
with
in
in
tern
e
t
o
f
th
in
g
s
(Io
T)
n
e
tw
o
rk
s,
t
h
e
re
b
y
y
ield
in
g
e
n
h
a
n
c
e
d
d
e
tec
ti
o
n
a
c
c
u
ra
c
y
,
a
s
we
ll
a
s
a
re
a
l
-
ti
m
e
se
c
u
rit
y
t
h
re
a
t
re
sp
o
n
se
.
Th
e
e
x
p
e
rime
n
tal
e
v
a
lu
a
ti
o
n
o
n
t
wo
b
e
n
c
h
m
a
rk
d
a
tas
e
ts,
n
a
m
e
ly
t
h
e
In
S
DN
d
a
tas
e
t
a
n
d
a
re
a
l
-
ti
m
e
d
a
tas
e
t
u
t
i
li
z
in
g
a
M
in
i
n
e
t
a
n
d
P
OX
c
o
n
tr
o
ll
e
r
se
tu
p
,
sh
o
ws
th
a
t
a
d
e
tec
ti
o
n
ra
te
o
f
9
9
.
8
5
%
a
n
d
9
9
.
7
2
%
,
re
sp
e
c
ti
v
e
l
y
,
t
h
e
re
b
y
sh
o
wc
a
sin
g
t
h
e
p
ro
p
o
se
d
m
o
d
e
l’
s
a
b
il
it
y
t
o
d
iffere
n
t
iate
b
e
twe
e
n
leg
it
ima
te
a
n
d
m
a
li
c
io
u
s n
e
two
r
k
traffic
.
K
ey
w
o
r
d
s
:
Ad
ap
tiv
e
d
ir
ec
tio
n
al
lea
r
n
in
g
DDo
S a
ttack
d
etec
tio
n
Flo
w
d
ir
ec
tio
n
alg
o
r
ith
m
L
o
n
g
s
h
o
r
t
-
ter
m
m
e
m
o
r
y
So
f
twar
e
d
ef
in
ed
n
etwo
r
k
i
n
g
T
h
is i
s
a
n
o
p
e
n
a
c
c
e
ss
a
rticle
u
n
d
e
r th
e
CC B
Y
-
SA
li
c
e
n
se
.
C
o
r
r
e
s
p
o
nd
ing
A
uth
o
r
:
Asg
h
ar
A.
Asg
h
ar
ian
Sar
d
r
o
u
d
Dep
ar
tm
en
t o
f
E
lectr
ical
an
d
C
o
m
p
u
ter
E
n
g
in
ee
r
in
g
,
Ur
m
ia
Un
iv
er
s
ity
Ur
m
ia
5
7
5
6
1
5
1
8
1
8
,
I
r
a
n
E
m
ail: a
.
asg
h
ar
ian
@
u
r
m
ia.
ac
.
ir
1.
I
NT
RO
D
UCT
I
O
N
So
f
twar
e
-
d
ef
in
e
d
n
etwo
r
k
in
g
(
SDN)
is
a
tr
an
s
f
o
r
m
ativ
e
p
ar
ad
ig
m
th
at
r
ed
ef
in
es
tr
ad
itio
n
al
n
etwo
r
k
m
an
ag
em
en
t
b
y
d
ec
o
u
p
lin
g
th
e
co
n
tr
o
l
p
la
n
e
f
r
o
m
th
e
d
ata
p
lan
e.
T
h
is
s
ep
ar
atio
n
o
f
f
er
s
u
n
p
r
ec
ed
en
te
d
f
lex
ib
ilit
y
,
ce
n
tr
alize
d
o
r
c
h
estra
tio
n
,
an
d
p
r
o
g
r
am
m
ab
ilit
y
[
1
]
.
Ho
wev
er
,
th
is
v
er
y
f
lex
ib
i
lity
also
in
tr
o
d
u
ce
s
n
ew
s
ec
u
r
ity
v
u
ln
er
a
b
ilit
ies,
p
ar
ticu
lar
ly
th
e
r
is
k
o
f
d
is
tr
ib
u
ted
d
en
ial
o
f
s
er
v
ice
(
DDo
S)
a
ttack
s
tar
g
etin
g
th
e
SDN
co
n
tr
o
ller
[
2
]
.
T
h
ese
attac
k
s
ca
n
ex
h
au
s
t
th
e
co
n
tr
o
ller
’
s
r
eso
u
r
ce
s
,
d
is
r
u
p
t
p
ac
k
et
f
o
r
war
d
in
g
,
an
d
lead
to
co
m
p
lete
s
er
v
ice
d
e
n
ial
ac
r
o
s
s
th
e
n
etwo
r
k
.
As
SDN
b
ec
o
m
es
a
co
r
n
er
s
to
n
e
in
m
o
d
er
n
en
ter
p
r
is
e
an
d
in
ter
n
et
o
f
th
in
g
s
(
I
o
T
)
in
f
r
astru
ctu
r
es,
s
ec
u
r
in
g
it
ag
ain
s
t
s
u
ch
d
y
n
am
ic
an
d
lar
g
e
-
s
ca
le
attac
k
s
h
as
b
ec
o
m
e
a
cr
itical
r
esear
ch
co
n
ce
r
n
[
3
]
.
C
o
n
v
en
tio
n
al
s
ig
n
at
u
r
e
-
b
ase
d
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
tem
s
(
I
DS)
ar
e
o
f
ten
in
ef
f
ec
tiv
e
i
n
SDN
en
v
ir
o
n
m
e
n
ts
d
u
e
to
t
h
eir
r
elian
ce
o
n
p
r
ed
ef
in
ed
p
atter
n
s
an
d
in
ab
ilit
y
to
ad
ap
t
to
n
o
v
el
o
r
ev
o
lv
in
g
th
r
ea
ts
[
4
]
,
[
5
]
.
T
o
ad
d
r
ess
th
ese
lim
itatio
n
s
,
r
ec
en
t
r
esear
ch
h
as
e
x
p
lo
r
ed
th
e
u
s
e
o
f
m
ac
h
in
e
lear
n
in
g
(
ML
)
a
n
d
d
ee
p
lear
n
i
n
g
(
DL
)
tech
n
iq
u
es
f
o
r
a
n
o
m
aly
d
etec
tio
n
[
6
]
,
[
7
]
.
No
tab
ly
,
b
id
ir
ec
tio
n
al
lo
n
g
s
h
o
r
t
-
ter
m
m
em
o
r
y
(
B
iLST
M)
n
etwo
r
k
s
[
8
]
,
tr
an
s
f
o
r
m
e
r
-
b
ased
a
r
ch
itectu
r
es
s
u
c
h
as
DDo
SViT
[
9
]
,
a
n
d
h
y
b
r
id
SDN
-
in
teg
r
ated
s
y
s
tem
s
lik
e
SNO
R
T
-
SDN
[
1
0
]
h
av
e
d
em
o
n
s
tr
ated
p
r
o
m
is
in
g
d
ete
ctio
n
p
er
f
o
r
m
an
ce
.
Ho
wev
er
,
th
ese
m
o
d
els
s
till
f
ac
e
cr
itical
ch
allen
g
es.
T
h
ey
ar
e
o
f
ten
s
tatic
in
n
atu
r
e,
s
u
f
f
er
f
r
o
m
h
ig
h
f
alse
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
F
lo
w
-
g
u
id
ed
l
o
n
g
s
h
o
r
t
-
term me
mo
r
y
w
ith
a
d
a
p
tive
d
ir
ec
tio
n
a
l
…
(
Hu
d
a
Mo
h
a
mme
d
I
b
a
d
i
)
5485
p
o
s
itiv
e
r
ates,
an
d
f
ail
to
d
y
n
am
ically
ad
ap
t
to
ch
a
n
g
es
in
tr
af
f
ic
p
atter
n
s
o
r
attac
k
b
eh
a
v
io
r
s
—
lim
itatio
n
s
th
at
ca
n
co
m
p
r
o
m
is
e
th
eir
e
f
f
e
ctiv
en
ess
in
r
ea
l
-
tim
e
SDN
d
ep
lo
y
m
en
ts
[
1
1
]
.
T
o
ad
d
r
ess
th
e
ab
o
v
e
is
s
u
es,
in
th
is
p
ap
er
,
we
in
tr
o
d
u
ce
a
n
ew
h
y
b
r
id
d
etec
tio
n
f
r
am
ew
o
r
k
,
f
lo
w
-
g
u
id
ed
lo
n
g
s
h
o
r
t
-
te
r
m
m
em
o
r
y
(
L
STM
)
with
a
d
ap
tiv
e
d
i
r
ec
tio
n
al
lear
n
i
n
g
(
ADL
)
.
T
h
e
m
o
d
el
in
teg
r
ates
th
r
ee
m
ajo
r
c
o
n
s
titu
en
ts
s
u
ch
as
th
e
f
lo
w
d
ir
ec
tio
n
alg
o
r
it
h
m
(
FDA)
t
h
at
an
al
y
ze
s
th
e
b
id
ir
ec
tio
n
al
f
lo
w
an
o
m
alies,
L
STM
n
etwo
r
k
to
ca
p
tu
r
e
th
e
s
eq
u
en
tial
d
ep
e
n
d
en
cies
in
th
e
n
etwo
r
k
tr
af
f
i
c,
an
d
an
ad
ap
tiv
e
d
y
n
am
ic
lear
n
in
g
m
ec
h
an
is
m
(
ADL
)
th
at
d
y
n
am
ically
ad
ju
s
ts
its
lear
n
in
g
p
ar
am
ete
r
s
ac
co
r
d
in
g
t
o
th
e
v
ar
y
in
g
attac
k
lan
d
s
ca
p
es.
B
y
co
m
b
i
n
in
g
FDA
an
d
ADA
co
m
b
in
e
d
with
L
STM
,
o
u
r
ap
p
r
o
ac
h
n
o
t
o
n
ly
en
h
an
ce
s
th
e
ac
cu
r
ac
y
o
f
t
h
e
d
etec
tio
n
,
b
u
t
also
im
p
r
o
v
es
th
e
r
esis
tan
ce
to
ze
r
o
-
d
ay
attac
k
s
an
d
f
alse
p
o
s
itiv
e,
wh
ich
ar
e
c
r
u
cial
f
o
r
a
SDN
-
b
ased
s
ec
u
r
ity
s
y
s
tem
.
T
h
is
ap
p
r
o
ac
h
d
if
f
er
s
f
r
o
m
p
r
e
v
io
u
s
o
n
es
in
wh
ich
d
ir
ec
tio
n
al
f
lo
w
ch
a
r
ac
ter
is
tics
an
d
ad
ap
tiv
e
lear
n
in
g
d
y
n
am
ics
ar
e
m
o
d
elled
ex
p
licitly
.
W
h
ile
m
o
s
t
ex
is
tin
g
m
eth
o
d
s
o
n
ly
co
n
s
id
e
r
th
e
tem
p
o
r
al
o
r
s
p
atial
asp
ec
t,
o
u
r
m
o
d
el
co
m
b
in
es
th
ese
t
wo
an
d
in
tr
o
d
u
ce
s
d
y
n
am
ic
a
d
ju
s
tm
en
t
o
f
th
e
th
r
esh
o
ld
th
r
o
u
g
h
ADL
.
T
h
e
s
y
s
tem
is
b
en
ch
m
ar
k
e
d
u
s
in
g
t
h
e
well
-
estab
lis
h
ed
I
n
SDN
b
en
c
h
m
ar
k
d
ataset
a
n
d
a
r
ea
l
-
tim
e
Min
in
et
-
b
ased
SDN
s
ce
n
ar
io
.
T
h
e
f
i
n
d
in
g
s
in
d
icate
9
9
.
8
5
%
d
etec
tio
n
p
er
f
o
r
m
an
ce
,
wh
ich
ex
ce
ed
s
ex
is
tin
g
s
tate
-
of
-
th
e
-
ar
t
m
o
d
els
in
clu
d
in
g
DDo
SNet
[
1
2
]
,
SNOR
T
-
SDN
[
1
0
]
an
d
DDo
SViT
[
9
]
,
th
er
e
b
y
v
alid
atin
g
th
e
ef
f
ec
tiv
en
ess
o
f
o
u
r
FDA
–
L
STM
–
ADL
f
u
s
io
n
f
o
r
s
ec
u
r
in
g
SDN
in
f
r
astru
ctu
r
es.
T
h
e
m
ain
co
n
t
r
ib
u
tio
n
s
o
f
th
i
s
p
ap
er
ar
e
th
r
ee
f
o
ld
.
I
t
in
tr
o
d
u
ce
s
a
n
ew
h
y
b
r
i
d
I
DS
ar
ch
itectu
r
e,
wh
ich
b
r
id
g
es
th
e
g
ap
b
etwe
en
FDA
-
d
r
iv
en
d
ir
ec
tio
n
al
f
l
o
w
an
aly
s
is
an
d
L
STM
-
b
ased
s
eq
u
en
ce
m
o
d
elin
g
an
d
th
e
A
DL
-
b
ased
f
lex
ib
ilit
y
.
Seco
n
d
,
it
r
ep
o
r
ts
an
em
p
ir
ical
s
tu
d
y
b
ased
o
n
b
e
n
ch
m
ar
k
d
atasets
an
d
r
ea
l
-
tim
e
d
ev
is
e
d
d
atasets
to
v
er
if
y
th
e
g
en
e
r
aliza
b
ilit
y
an
d
r
o
b
u
s
tn
ess
o
f
th
e
m
o
d
el.
T
h
ir
d
,
co
m
p
ar
is
o
n
a
g
ain
s
t
ex
is
tin
g
s
tate
-
of
-
th
e
-
ar
t
DDo
S
d
etec
tio
n
m
ec
h
an
is
m
s
d
em
o
n
s
tr
ates
th
e
s
u
p
er
io
r
ity
a
n
d
ef
f
ec
tiv
en
ess
o
f
th
e
p
r
o
p
o
s
ed
f
r
am
ewo
r
k
i
n
ter
m
s
o
f
ac
c
u
r
ac
y
,
ad
ap
tiv
ity
,
an
d
lo
w
f
alse a
lar
m
r
ate.
T
h
e
r
est
o
f
th
e
p
a
p
er
is
s
tr
u
ctu
r
ed
as
f
o
llo
ws:
s
ec
tio
n
2
d
is
cu
s
s
es
th
e
r
elate
d
wo
r
k
s
wh
ile
s
ec
tio
n
3
in
tr
o
d
u
ce
s
t
h
e
d
ee
p
lear
n
in
g
-
b
ased
DDo
S
d
etec
tio
n
alg
o
r
ith
m
b
ased
o
n
co
u
n
ter
f
ac
tu
al
r
ea
s
o
n
in
g
a
n
d
h
o
p
es
.
T
h
e
p
r
o
p
o
s
ed
FDA
-
L
STM
-
ADL
is
d
escr
ib
ed
in
s
ec
tio
n
3
,
lis
tin
g
f
o
r
m
u
latio
n
s
o
f
th
e
alg
o
r
ith
m
s
an
d
t
h
e
m
o
d
el
ar
c
h
itectu
r
es.
Sectio
n
4
p
r
esen
ts
th
e
e
x
p
er
im
e
n
tal
s
etu
p
,
th
e
d
atasets
,
th
e
attac
k
m
o
d
el,
th
e
e
v
alu
atio
n
m
eth
o
d
o
l
o
g
y
.
Sectio
n
5
i
n
tr
o
d
u
ce
s
th
e
r
esu
lts
an
d
d
is
cu
s
s
e
s
th
em
,
f
o
llo
wed
b
y
co
n
clu
s
io
n
s
an
d
o
u
tlo
o
k
s
in
s
ec
tio
n
6
.
2.
RE
L
AT
E
D
WO
RK
T
h
e
g
r
o
wi
n
g
a
cc
e
p
t
a
n
ce
o
f
S
DN
h
as
le
d
to
a
b
u
r
g
e
o
n
i
n
g
c
o
n
ce
r
n
r
e
g
a
r
d
i
n
g
i
ts
s
a
f
et
y
,
es
p
e
cia
ll
y
i
n
th
e
c
o
n
te
x
t
o
f
DD
o
S
att
ac
k
s
.
I
n
SDN
s
et
u
p
s
,
D
Do
S
att
ac
k
s
aim
at
s
e
v
e
r
al
n
etw
o
r
k
la
y
e
r
s
at
o
n
ce
,
wi
t
h
ea
c
h
lay
e
r
p
r
es
e
n
ti
n
g
a
d
is
t
in
ct
s
et
o
f
p
r
o
b
le
m
s
t
o
s
o
l
v
e
[
1
3
]
.
A
t
th
e
d
at
a
p
la
n
e
,
f
o
r
ex
am
p
l
e,
o
n
e
k
i
n
d
o
f
att
ac
k
in
v
o
l
v
es
s
at
u
r
at
in
g
t
h
e
i
n
t
er
f
a
c
es
b
e
twe
en
t
h
e
S
DN
c
o
n
tr
o
l
le
r
s
a
n
d
th
e
n
etw
o
r
k
d
e
v
i
ce
s
[
1
4
]
.
T
h
is
is
k
n
o
w
n
as
an
a
tta
ck
o
n
th
e
So
u
t
h
b
o
u
n
d
i
n
te
r
f
a
ce
[
1
5
]
.
A
n
o
t
h
e
r
k
i
n
d
o
f
atta
c
k
in
v
o
l
v
es
f
l
o
o
d
i
n
g
t
h
e
n
e
two
r
k
d
ev
ices
w
it
h
s
o
m
u
ch
tr
af
f
i
c
t
h
a
t t
h
e
y
c
a
n
no
t
h
a
n
d
le
it
an
d
,
as
a
r
es
u
lt
,
t
h
ey
s
ta
r
t
d
r
o
p
p
i
n
g
p
ac
k
e
ts
a
n
d
cr
ea
t
e
a
tr
af
f
i
c
ja
m
i
n
th
e
n
et
wo
r
k
.
A
n
d
s
till
a
n
o
t
h
e
r
k
i
n
d
o
f
atta
c
k
aim
s
a
t
th
e
f
l
o
w
tab
les
i
n
th
e
S
DN
s
wit
ch
es
th
e
m
s
el
v
es
[
1
6
]
.
At
th
e
co
n
tr
o
l
p
lan
e,
th
e
p
ac
k
et
-
in
f
lo
o
d
i
n
g
attac
k
s
en
d
s
ex
ce
s
s
iv
e
m
es
s
ag
e
tr
af
f
ic
to
th
e
SDN
co
n
tr
o
ller
,
s
tr
ain
in
g
its
alr
ea
d
y
lim
ited
ca
p
ac
ity
an
d
at
tim
e
s
ev
en
ca
u
s
in
g
it
to
to
tally
lo
s
e
its
ab
ilit
y
to
s
er
v
e
leg
itima
te
r
eq
u
ests
.
W
h
en
th
is
h
ap
p
en
s
,
s
er
v
ice
d
is
r
u
p
tio
n
m
ay
well
b
e
u
n
d
er
way
,
an
d
th
e
SDN
will
n
o
t
b
e
ab
le
to
p
er
f
o
r
m
an
y
o
f
its
c
o
n
tr
o
ller
f
u
n
ctio
n
s
.
E
x
ce
p
t
f
o
r
t
h
e
wo
r
s
t
-
ca
s
e
s
ce
n
ar
i
o
,
t
h
e
a
m
o
u
n
t
o
f
d
is
r
u
p
ti
o
n
s
er
v
ed
u
p
in
th
e
c
o
n
tr
o
l
p
lan
e
b
y
p
ac
k
et
-
i
n
f
lo
o
d
in
g
is
,
in
f
ac
t,
q
u
ite
ca
p
ab
le
o
f
s
er
v
i
n
g
s
im
ilar
am
o
u
n
ts
o
f
d
is
r
u
p
tio
n
th
at
o
th
er
p
er
f
o
r
m
a
tiv
e
d
en
ial
-
of
-
s
er
v
ice
(
PDo
S)
attac
k
s
d
o
in
tr
ad
itio
n
al
n
etwo
r
k
ed
s
y
s
tem
s
[
1
7
]
.
B
lo
ck
in
g
attac
k
s
h
av
e
a
s
ec
o
n
d
ar
y
lin
e
o
f
tar
g
ete
d
v
ictim
s
o
n
th
e
ap
p
licatio
n
s
id
e,
b
u
t
s
er
v
ice
d
en
ial
is
n
o
t
th
eir
o
n
ly
aim
.
T
h
ey
ar
e
also
m
ea
n
t
to
in
cr
ea
s
e
th
e
o
p
p
o
r
tu
n
ity
f
o
r
an
attac
k
e
r
to
p
er
f
o
r
m
a
d
ata
ex
f
iltra
tio
n
o
p
er
atio
n
.
T
ab
le
1
s
u
m
m
ar
izes th
ese
attac
k
s
an
d
th
eir
im
p
ac
ts
o
n
th
e
f
o
u
r
lay
er
s
o
f
th
e
SDN
[
1
8
]
.
Dif
f
er
en
t
tech
n
iq
u
es
h
av
e
b
ee
n
s
u
g
g
ested
to
r
e
d
u
ce
th
e
im
p
ac
t
o
f
DDo
S
attac
k
s
.
On
e
tech
n
iq
u
e
is
to
u
s
e
in
-
n
etwo
r
k
d
ef
e
n
s
e
m
ec
h
an
is
m
s
,
wh
ich
ar
e
q
u
ite
d
if
f
er
en
t
f
r
o
m
tr
ad
itio
n
al
d
e
f
en
s
e
m
ec
h
an
is
m
s
th
at
ar
e
lo
ca
ted
o
n
th
e
p
er
im
eter
o
f
th
e
p
r
o
tecte
d
n
etwo
r
k
[
1
9
]
.
I
n
-
n
etwo
r
k
d
ef
e
n
s
e
m
ec
h
an
is
m
s
r
eq
u
ir
e
ac
tiv
e
p
ar
ticip
atio
n
f
r
o
m
ea
ch
n
etwo
r
k
s
witch
an
d
h
av
e
b
ee
n
s
h
o
wn
to
allo
w
lo
w
-
r
ate
DDo
S
a
ttack
tr
af
f
ic
th
r
o
u
g
h
wh
ile
b
lo
ck
in
g
th
e
h
ig
h
-
r
ate
DDo
S
tr
af
f
ic
at
th
e
p
er
im
eter
.
T
h
is
is
h
elp
f
u
l
in
r
ed
u
cin
g
th
e
E
/E
f
ac
to
r
th
at
is
cr
itical
to
th
e
DDo
S a
ttack
f
r
o
m
s
u
cc
ee
d
in
g
[
2
0
]
.
Oth
er
m
eth
o
d
s
m
er
g
e
tech
n
i
q
u
es
th
at
a
r
e
b
ased
o
n
en
t
r
o
p
y
with
m
o
d
els
t
h
at
r
esu
lt
f
r
o
m
d
ee
p
lear
n
in
g
to
e
n
ab
le
th
e
d
etec
tio
n
a
n
d
m
itig
atio
n
o
f
DDo
S
attac
k
s
th
at
tar
g
et
SDN
co
n
t
r
o
ller
s
[
2
1
]
.
T
h
ese
m
o
d
els
p
er
f
o
r
m
ca
lcu
latio
n
s
o
f
n
etwo
r
k
en
t
r
o
p
y
to
en
ab
le
th
e
id
en
tific
atio
n
o
f
an
o
m
alo
u
s
tr
af
f
ic
an
d
m
ak
e
u
s
e
o
f
m
ac
h
in
e
lear
n
in
g
tech
n
iq
u
es,
s
u
ch
as
b
id
ir
ec
tio
n
al
lo
n
g
s
h
o
r
t
-
te
r
m
m
em
o
r
y
(
B
i
-
L
STM
)
,
to
en
h
an
ce
th
e
ac
cu
r
ac
y
o
f
d
etec
tio
n
[
8
]
.
I
n
ad
d
itio
n
,
a
p
p
r
o
ac
h
es
th
at
ar
e
b
ased
o
n
th
e
ca
lc
u
latio
n
o
f
R
en
y
i
en
tr
o
p
y
h
a
v
e
b
ee
n
ex
p
lo
r
ed
to
ca
p
tu
r
e
an
o
m
alies
in
n
etwo
r
k
f
lo
w
an
d
e
n
ab
le
th
e
ex
tr
ac
tio
n
o
f
k
ey
tr
af
f
ic
f
ea
tu
r
es
f
r
o
m
SDN
f
lo
w
tab
les,
wh
ich
ar
e
th
en
u
s
ed
to
id
e
n
tify
b
eh
av
io
r
s
th
at
ar
e
m
alicio
u
s
in
n
atu
r
e
[
2
2
]
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
4
8
4
-
5
4
9
6
5486
T
ab
le
1
.
Su
m
m
a
r
y
o
f
DDo
S
at
tack
s
tar
g
etin
g
d
if
f
er
en
t la
y
e
r
s
o
f
SDN
La
y
e
r
A
t
t
a
c
k
t
y
p
e
D
e
scri
p
t
i
o
n
I
mp
a
c
t
D
a
t
a
p
l
a
n
e
S
o
u
t
h
b
o
u
n
d
i
n
t
e
r
f
a
c
e
(
S
B
I
)
a
t
t
a
c
k
D
i
sr
u
p
t
s
c
o
mm
u
n
i
c
a
t
i
o
n
b
e
t
w
e
e
n
t
h
e
S
D
N
c
o
n
t
r
o
l
l
e
r
a
n
d
n
e
t
w
o
r
k
d
e
v
i
c
e
s
.
N
e
t
w
o
r
k
d
i
sr
u
p
t
i
o
n
a
n
d
c
o
n
t
r
o
l
l
o
ss.
B
u
f
f
e
r
s
a
t
u
r
a
t
i
o
n
a
t
t
a
c
k
F
l
o
o
d
s
n
e
t
w
o
r
k
d
e
v
i
c
e
s wi
t
h
e
x
c
e
ssi
v
e
t
r
a
f
f
i
c
,
c
a
u
si
n
g
p
a
c
k
e
t
l
o
ss
a
n
d
c
o
n
g
e
st
i
o
n
.
P
a
c
k
e
t
l
o
ss
a
n
d
d
e
v
i
c
e
o
v
e
r
l
o
a
d
.
F
l
o
w
m
e
t
e
r
o
v
e
r
f
l
o
w
O
v
e
r
w
h
e
l
ms
t
h
e
f
l
o
w
t
a
b
l
e
w
i
t
h
e
x
c
e
ssi
v
e
e
n
t
r
i
e
s
,
c
a
u
s
i
n
g
n
e
t
w
o
r
k
d
i
sr
u
p
t
i
o
n
s.
R
e
s
o
u
r
c
e
e
x
h
a
u
s
t
i
o
n
a
n
d
f
l
o
w
t
a
b
l
e
sa
t
u
r
a
t
i
o
n
.
C
o
n
t
r
o
l
p
l
a
n
e
P
a
c
k
e
t
-
i
n
f
l
o
o
d
i
n
g
S
e
n
d
s e
x
c
e
ss
i
v
e
me
ssa
g
e
t
r
a
f
f
i
c
t
o
t
h
e
S
D
N
c
o
n
t
r
o
l
l
e
r
,
o
v
e
r
w
h
e
l
mi
n
g
i
t
s
p
r
o
c
e
ss
i
n
g
c
a
p
a
c
i
t
y
.
S
e
r
v
i
c
e
d
i
sr
u
p
t
i
o
n
d
u
e
t
o
c
o
n
t
r
o
l
l
e
r
o
v
e
r
l
o
a
d
.
D
a
t
a
c
h
a
n
n
e
l
b
l
o
c
k
i
n
g
B
l
o
c
k
s
c
o
mm
u
n
i
c
a
t
i
o
n
c
h
a
n
n
e
l
s
b
e
t
w
e
e
n
t
h
e
c
o
n
t
r
o
l
l
e
r
a
n
d
d
e
v
i
c
e
s
.
R
e
d
u
c
e
s
e
f
f
e
c
t
i
v
e
c
o
mm
u
n
i
c
a
t
i
o
n
.
A
p
p
l
i
c
a
t
i
o
n
p
l
a
n
e
N
o
r
t
h
b
o
u
n
d
i
n
t
e
r
f
a
c
e
(
N
B
I
)
a
t
t
a
c
k
Ex
p
l
o
i
t
s
v
u
l
n
e
r
a
b
i
l
i
t
i
e
s i
n
t
h
e
c
o
mm
u
n
i
c
a
t
i
o
n
b
e
t
w
e
e
n
t
h
e
S
D
N
c
o
n
t
r
o
l
l
e
r
a
n
d
a
p
p
l
i
c
a
t
i
o
n
s.
R
e
s
o
u
r
c
e
c
o
n
s
u
m
p
t
i
o
n
a
n
d
p
e
r
f
o
r
m
a
n
c
e
d
e
g
r
a
d
a
t
i
o
n
.
A
p
p
l
i
c
a
t
i
o
n
r
e
so
u
r
c
e
a
t
t
a
c
k
O
v
e
r
u
s
e
s
c
o
m
p
u
t
a
t
i
o
n
a
l
r
e
s
o
u
r
c
e
s
,
d
e
g
r
a
d
i
n
g
t
h
e
o
v
e
r
a
l
l
p
e
r
f
o
r
ma
n
c
e
o
f
t
h
e
a
p
p
l
i
c
a
t
i
o
n
p
l
a
n
e
.
S
y
st
e
m res
o
u
r
c
e
e
x
h
a
u
s
t
i
o
n
.
Mo
d
els
b
ased
o
n
m
ac
h
in
e
lear
n
in
g
an
d
d
ee
p
lear
n
in
g
h
av
e
a
ls
o
b
ee
n
p
u
t
to
u
s
e
f
o
r
DDo
S
d
etec
tio
n
.
Su
p
p
o
r
t
v
ec
to
r
m
ac
h
in
es
(
SVM)
an
d
d
ee
p
n
e
u
r
al
n
etwo
r
k
s
(
DNN)
ar
e
ap
p
lied
o
f
ten
to
cla
s
s
if
y
th
e
p
atter
n
s
o
f
n
etwo
r
k
tr
af
f
ic
an
d
to
d
is
tin
g
u
is
h
b
etwe
en
tr
af
f
ic
th
at
is
n
o
r
m
al
an
d
th
at
wh
ich
is
h
ar
m
f
u
l,
with
a
r
ea
l
-
tim
e
d
etec
tio
n
ca
p
a
b
ilit
y
b
ein
g
a
m
ajo
r
f
o
cu
s
o
f
s
u
ch
ef
f
o
r
ts
[
2
3
]
.
Desp
ite
s
o
m
e
p
r
o
m
is
in
g
r
esu
lts
,
th
ese
m
o
d
els
ar
e
s
till
f
ac
in
g
ch
allen
g
es,
n
a
m
ely
s
ca
lab
ilit
y
an
d
ad
a
p
tab
ilit
y
,
esp
ec
ially
wh
en
th
ey
ar
e
u
p
ag
ain
s
t
ev
o
lv
in
g
attac
k
s
tr
ateg
ies
an
d
co
m
p
lex
n
etwo
r
k
tr
af
f
ic
[
1
1
]
.
T
o
s
u
m
u
p
,
alth
o
u
g
h
s
u
b
s
tan
tial
ad
v
an
ce
m
en
ts
h
av
e
b
ee
n
ac
h
iev
ed
in
cr
af
tin
g
DDo
S
d
etec
tio
n
s
y
s
tem
s
s
p
ec
if
ically
f
o
r
SDN,
th
e
v
er
y
n
atu
r
e
o
f
SDN
—
d
y
n
am
ic
an
d
ev
er
-
ch
a
n
g
in
g
—
d
e
m
an
d
s
th
at
d
etec
tio
n
m
o
d
els
b
e
ad
a
p
ted
an
d
en
h
an
ce
d
co
n
tin
u
o
u
s
ly
to
ef
f
ec
tiv
ely
d
ea
l
with
th
e
attac
k
tech
n
iq
u
es th
at
ar
e
d
iv
er
s
e
an
d
n
u
m
er
o
u
s
.
3.
P
RO
P
O
SE
D
M
E
T
H
O
D
T
h
is
s
ec
tio
n
d
escr
ib
es
th
e
ar
ch
itectu
r
e,
alg
o
r
ith
m
s
,
a
n
d
p
r
o
ce
d
u
r
es
u
s
ed
in
t
h
e
d
esig
n
an
d
im
p
lem
en
tatio
n
o
f
th
e
p
r
o
p
o
s
ed
in
tr
u
s
io
n
d
etec
tio
n
m
o
d
e
l,
wh
ich
in
teg
r
ates
FDA
,
L
STM
,
an
d
ADL
t
o
en
h
an
ce
th
e
d
etec
tio
n
o
f
DDo
S
attac
k
s
in
SDN
en
v
ir
o
n
m
en
ts
.
T
h
e
g
o
al
is
to
en
s
u
r
e
h
ig
h
d
etec
tio
n
ac
cu
r
ac
y
,
lo
w
f
alse
p
o
s
itiv
es,
an
d
ad
ap
tab
ilit
y
to
ev
o
lv
in
g
attac
k
s
tr
ateg
ies
[
2
4
]
.
T
h
e
m
eth
o
d
o
l
o
g
y
co
n
s
is
ts
o
f
th
r
ee
co
r
e
m
o
d
u
les:
f
lo
w
-
b
ased
f
e
atu
r
e
ex
tr
ac
tio
n
,
s
eq
u
e
n
tial
a
n
aly
s
is
,
an
d
ad
a
p
tiv
e
lear
n
in
g
.
T
h
is
s
ec
tio
n
also
o
u
tlin
es
th
e
im
p
lem
en
tatio
n
p
ip
elin
e
in
d
etail
to
en
s
u
r
e
r
ep
r
o
d
u
cib
ilit
y
.
A
d
etailed
w
o
r
k
f
l
o
w
o
f
th
e
m
o
d
el
is
illu
s
tr
ated
in
Fig
u
r
e
1
.
Fig
u
r
e
1
illu
s
tr
ates
th
e
o
v
er
all
wo
r
k
f
lo
w
o
f
t
h
e
p
r
o
p
o
s
ed
h
y
b
r
id
in
tr
u
s
io
n
d
etec
tio
n
m
o
d
el.
I
t
s
h
o
ws
h
o
w
tr
af
f
ic
f
lo
ws
ar
e
f
ir
s
t
p
r
o
ce
s
s
ed
th
r
o
u
g
h
th
e
FDA
f
o
r
f
ea
tu
r
e
ex
tr
ac
tio
n
,
th
e
n
an
al
y
ze
d
b
y
an
L
STM
n
etwo
r
k
en
h
a
n
ce
d
with
ADL
.
T
h
e
o
u
tp
u
t
is
class
if
ied
as
b
en
ig
n
o
r
m
alicio
u
s
b
eh
a
v
io
r
b
a
s
ed
o
n
th
e
lear
n
ed
tem
p
o
r
al
an
d
d
ir
ec
tio
n
al
p
atte
r
n
s
.
Fig
u
r
e
1
.
W
o
r
k
f
lo
w
o
f
th
e
p
r
o
p
o
s
ed
h
y
b
r
id
L
STM
-
b
ased
d
et
ec
tio
n
m
o
d
el
3
.
1
.
F
l
o
w
direct
io
n a
na
ly
s
is
us
ing
F
DA
T
h
e
FDA
is
a
n
o
v
el
m
ec
h
an
is
m
d
esig
n
ed
to
e
x
tr
ac
t
d
ir
ec
tio
n
al
ch
ar
ac
te
r
is
tics
f
r
o
m
S
DN
tr
af
f
ic
f
lo
ws.
Un
lik
e
c
o
n
v
e
n
tio
n
al
s
tatis
tical
o
r
f
lo
w
-
b
ased
m
eth
o
d
s
,
FDA
f
o
c
u
s
es
o
n
b
id
ir
e
ctio
n
al
p
atter
n
s
b
y
an
aly
zin
g
ea
ch
f
lo
w’
s
in
itiatio
n
,
s
eq
u
en
ce
b
eh
av
io
r
,
ter
m
in
atio
n
,
an
d
co
m
m
u
n
icatio
n
co
n
s
is
ten
cy
.
T
h
e
f
ea
tu
r
es e
x
tr
ac
ted
b
y
FDA
in
c
lu
d
e:
a.
Flo
w
in
itiatio
n
f
r
eq
u
e
n
cy
: d
et
ec
ts
u
n
u
s
u
al
s
p
ik
es in
th
e
n
u
m
b
er
o
f
n
ew
co
n
n
ec
tio
n
s
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
F
lo
w
-
g
u
id
ed
l
o
n
g
s
h
o
r
t
-
term me
mo
r
y
w
ith
a
d
a
p
tive
d
ir
ec
tio
n
a
l
…
(
Hu
d
a
Mo
h
a
mme
d
I
b
a
d
i
)
5487
b.
Pack
et
s
eq
u
en
ce
v
ar
iatio
n
: f
la
g
s
r
eo
r
d
er
i
n
g
o
r
ir
r
e
g
u
lar
p
ac
k
et
f
lo
ws s
u
g
g
esti
v
e
o
f
s
p
o
o
f
in
g
.
c.
Flo
w
ter
m
in
atio
n
an
o
m
alies: ca
p
tu
r
es a
b
n
o
r
m
al
d
is
co
n
n
ec
tio
n
s
o
r
tim
eo
u
ts
.
d.
So
u
r
ce
-
d
esti
n
atio
n
c
o
n
s
is
ten
cy
: id
en
tifie
s
m
is
m
atch
es in
ex
p
ec
ted
co
m
m
u
n
icatio
n
p
ath
s
.
T
h
e
lo
g
ic
o
f
FDA
is
p
r
esen
ted
in
Alg
o
r
ith
m
1
,
wh
ic
h
d
esc
r
ib
es
th
e
s
tep
-
by
-
s
tep
e
x
tr
ac
tio
n
o
f
th
ese
f
ea
tu
r
es
f
r
o
m
r
aw
tr
a
f
f
ic
f
lo
ws.
On
ce
co
m
p
u
te
d
,
th
ese
f
ea
tu
r
es
f
o
r
m
th
e
in
p
u
t
v
ec
t
o
r
s
f
o
r
s
u
b
s
eq
u
en
t
s
eq
u
en
tial
m
o
d
elin
g
.
As
illu
s
tr
ated
in
Fig
u
r
e
2
,
th
e
ap
p
licatio
n
o
f
FDA
r
esu
lts
in
im
p
r
o
v
ed
f
lo
w
u
n
if
o
r
m
it
y
an
d
r
ed
u
ce
d
laten
c
y
,
wh
ich
s
u
p
p
o
r
ts
b
etter
an
o
m
al
y
v
is
ib
ilit
y
an
d
class
if
icatio
n
.
Fig
u
r
e
2
d
em
o
n
s
tr
ates
th
e
ef
f
ec
tiv
en
ess
o
f
th
e
FDA
in
o
p
tim
izin
g
n
etwo
r
k
tr
af
f
ic.
I
n
Fig
u
r
e
2
(
a)
,
it
s
h
o
ws
h
o
w
p
ac
k
et
f
lo
w
d
is
tr
ib
u
tio
n
b
ec
o
m
es
m
o
r
e
b
alan
ce
d
af
ter
FDA
is
ap
p
lied
,
r
ed
u
cin
g
tr
a
f
f
ic
s
p
ik
es.
Fig
u
r
e
2
(
b
)
h
ig
h
lig
h
ts
th
e
r
ed
u
ctio
n
in
laten
cy
,
illu
s
tr
atin
g
im
p
r
o
v
ed
n
etwo
r
k
r
esp
o
n
s
iv
en
ess
.
T
o
g
e
th
er
,
th
e
y
v
alid
ate
FDA'
s
r
o
le
in
e
n
h
an
cin
g
f
lo
w
co
n
s
is
ten
cy
an
d
a
n
o
m
aly
d
ete
ctio
n
ef
f
icien
cy
.
Alg
o
r
ith
m
1
.
Flo
w
d
ir
ec
tio
n
a
n
aly
s
is
u
s
in
g
FDA
Input: Traffic_Flows (network packets), FDA (Flow Direction Algorithm)
Output: Flow_Characteristics (extracted bidirectional traffic features)
1. Initialize Flow_Characteristics ←
∅
2. For each flow F in Traffic_Flows do:
a. Extract Flow_Initiation_Frequency(F)
b. Compute Packet_Sequence_Variation(F)
c. Identify Flow_Termination_Anomalies(F)
d. Assess Source_Destination_Consistency(F)
3. Store extracted Flow_Characteristics
4. Apply FDA to analyze bidirectional traffic patterns
5. Return Flow_Characteristics
(
a)
(
b
)
Fig
u
r
e
2
.
Flo
w
-
o
p
tim
izatio
n
a
n
aly
s
is
with
(
FDA)
v
is
u
aliza
ti
o
n
: (
a)
p
ac
k
et
d
is
tr
ib
u
tio
n
b
ef
o
r
e
v
s
.
af
ter
FDA
an
d
(
b
)
laten
cy
c
o
m
p
ar
is
o
n
b
e
f
o
r
e
v
s
,
af
te
r
FDA
3
.
2
.
ADL
T
o
ac
h
iev
e
t
h
e
p
r
o
p
o
s
ed
s
ch
em
e,
in
t
h
e
p
r
o
ce
s
s
in
g
s
tag
e,
ADL
is
in
tr
o
d
u
ce
d
to
im
p
r
o
v
e
th
e
ad
ap
tab
ilit
y
o
f
th
e
d
etec
tio
n
m
o
d
el
o
f
r
ail
s
u
r
f
ac
e
d
ef
ec
t,
wh
ich
alwa
y
s
ad
ju
s
t
th
e
in
ter
n
al
p
ar
am
eter
s
in
r
ea
l
-
tim
e.
ADL
d
o
es
n
o
t
n
ee
d
s
tatic
m
o
d
els,
wh
ile
ad
ap
tin
g
t
o
co
n
ce
p
t
d
r
if
t,
n
ew
attac
k
p
atter
n
s
,
an
d
tr
af
f
ic
b
eh
av
io
r
s
,
s
o
t
h
at
th
e
u
n
d
er
ly
i
n
g
lo
g
ic
ca
n
b
e
a
d
ju
s
ted
au
to
m
atica
lly
.
T
h
e
ADL
p
er
f
o
r
m
s
its
wo
r
k
b
ased
o
n
th
r
ee
m
ai
n
m
is
s
io
n
s
.
I
t d
o
es f
ir
s
t,
o
b
s
er
v
e
p
r
e
-
p
atter
n
er
r
o
r
s
by
tr
ac
k
in
g
a
s
lid
in
g
win
d
o
w
o
f
p
r
ed
icate
er
r
o
r
s
an
d
id
en
tif
y
in
g
wh
en
th
e
m
o
d
el
s
tar
ts
to
m
is
class
if
y
d
ata
b
ec
au
s
e
o
f
ch
an
g
i
n
g
tr
af
f
ic
p
atter
n
.
Seco
n
d
,
it
s
elec
tiv
ely
u
p
d
ates
weig
h
ts
in
th
e
L
ST
M
lay
er
s
with
m
in
i
-
b
atch
g
r
ad
ien
t
d
escen
t,
th
er
eb
y
allo
win
g
lig
h
tweig
h
t
r
e
-
tr
ai
n
in
g
with
o
u
t
r
esettin
g
th
e
co
m
p
lete
m
o
d
el.
T
h
ir
d
,
it
ad
o
p
ts
liv
e
tr
af
f
ic
f
ee
d
b
ac
k
to
ca
lib
r
ate
d
ec
is
io
n
th
r
esh
o
ld
s
s
o
th
at
th
e
d
etec
tio
n
s
en
s
i
t
iv
ity
an
d
th
e
f
alse
p
o
s
itiv
e
r
ate
ca
n
b
e
co
n
tr
o
lled
.
T
h
e
f
o
r
m
al
p
r
o
ce
s
s
o
f
d
o
in
g
d
is
tr
ib
u
ted
ADL
is
d
escr
ib
ed
in
Alg
o
r
ith
m
2
,
wh
ic
h
s
p
ec
if
ies
th
e
way
s
we
id
en
tify
n
ew
p
atter
n
s
,
r
ec
o
m
p
u
te
th
r
esh
o
l
d
s
,
an
d
s
o
m
etim
es
f
in
e
-
tu
n
e
th
e
m
o
d
el
weig
h
ts
.
I
t
h
elp
s
in
r
etain
in
g
th
e
r
o
b
u
s
tn
ess
o
f
th
e
m
o
d
el
to
f
ast ev
o
lv
in
g
n
etwo
r
k
co
n
d
itio
n
s
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
4
8
4
-
5
4
9
6
5488
Alg
o
r
ith
m
1
.
ADL
o
p
tim
izatio
n
Input: LSTM_Model (trained model), Attack_Patterns (new DDoS variations)
Output: Optimized_LSTM_Model
1.
Watch for unnoticed assault patterns in currently available network traffic.
2.
In the event that New_Attack_Patterns are detected:
a.
Modify LSTM_Weights through the use of gradient updates.
b.
LSTM_Model with updated dataset to retrain.
c.
Use cross
-
entropy loss to validate performance.
3.
Keep on with adaptive learning until convergence is reached.
4.
Provide the Optimized LSTM Model as output.
3
.
3
.
L
ST
M
-
ba
s
ed
s
eque
ntia
l le
a
rning
L
STM
n
etwo
r
k
s
ar
e
em
p
lo
y
ed
to
m
o
d
el
t
h
e
tem
p
o
r
al
p
r
o
g
r
ess
io
n
o
f
tr
a
f
f
ic
f
lo
ws.
Giv
en
th
at
n
etwo
r
k
b
eh
a
v
io
r
o
f
ten
ev
o
lv
es
o
v
er
tim
e,
L
STM
is
a
n
id
ea
l
ar
ch
itectu
r
e
f
o
r
id
e
n
tify
in
g
lo
n
g
-
ter
m
d
ep
en
d
e
n
cies
an
d
d
ev
iatio
n
s
f
r
o
m
n
o
r
m
al
s
eq
u
en
ce
p
atter
n
s
.
T
h
e
L
STM
-
b
ased
ar
c
h
itectu
r
e
b
e
g
in
s
with
a
n
in
p
u
t
lay
e
r
th
at
i
n
g
ests
FDA
-
d
er
iv
ed
f
ea
t
u
r
es.
T
h
is
is
f
o
llo
w
ed
b
y
a
h
id
d
en
L
STM
lay
er
c
o
m
p
r
is
in
g
6
4
u
n
its
,
ca
p
ab
le
o
f
en
co
d
in
g
f
l
o
w
d
y
n
am
ics
o
v
er
tim
e.
A
d
r
o
p
o
u
t
lay
er
(
with
a
r
ate
o
f
0
.
2
)
is
u
s
ed
to
r
ed
u
ce
o
v
er
f
itti
n
g
.
T
h
e
o
u
tp
u
t
lay
er
em
p
lo
y
s
a
So
f
tMa
x
ac
tiv
atio
n
f
u
n
ctio
n
to
class
if
y
in
p
u
ts
as
eith
er
b
en
ig
n
o
r
attac
k
tr
af
f
ic.
T
r
ain
in
g
is
co
n
d
u
cted
u
s
in
g
th
e
Ad
am
o
p
tim
izer
with
a
lear
n
in
g
r
ate
o
f
0
.
0
0
1
an
d
a
b
atch
s
ize
o
f
6
4
,
o
v
er
5
0
ep
o
c
h
s
.
C
ateg
o
r
ical
cr
o
s
s
-
en
tr
o
p
y
is
u
s
ed
as
th
e
lo
s
s
f
u
n
ctio
n
d
u
e
to
its
s
u
itab
ilit
y
f
o
r
b
i
n
ar
y
class
if
icatio
n
task
s
.
T
h
e
o
v
er
a
ll
s
eq
u
en
ce
o
f
o
p
er
atio
n
s
,
f
r
o
m
FDA
p
r
ep
r
o
ce
s
s
in
g
to
L
ST
M
class
if
icatio
n
,
is
en
ca
p
s
u
lated
in
Alg
o
r
ith
m
3
,
wh
ich
o
u
tlin
es
th
e
d
ata
tr
an
s
f
o
r
m
atio
n
,
t
r
ain
in
g
,
an
d
in
f
e
r
en
ce
s
tep
s
u
s
ed
to
d
etec
t a
n
o
m
alies b
ased
o
n
s
eq
u
en
tial le
ar
n
in
g
.
Alg
o
r
ith
m
3
.
Hy
b
r
id
L
STM
-
b
ased
an
o
m
aly
d
etec
tio
n
Input: FD_Features (Flow Direction selected features), Model (CNN+LSTM)
Output: Predicted_Labels (normal or attack classification)
1. Preprocess FD_Features
for neural network input
2. Pass FD_Features through CNN_Layer to extract spatial dependencies
3. Feed CNN output into LSTM_Layer to learn sequential relationships
4. Apply Softmax_Activation to obtain classification probabilities
5. Assign
Predicted_Labels based on highest probability class
6. Return Predicted_Labels
3
.
4
.
Da
t
a
prepro
ce
s
s
ing
a
nd
f
ea
t
ure
eng
ineering
Pre
p
r
o
ce
s
s
in
g
is
a
cr
itical
s
tag
e
th
at
p
r
ep
a
r
es r
aw
d
ata
f
o
r
m
o
d
el
in
g
esti
o
n
.
T
h
e
p
r
o
ce
s
s
in
v
o
lv
es:
a.
Featu
r
e
e
x
tr
ac
tio
n
:
Selectin
g
k
ey
attr
ib
u
tes
s
u
ch
as
s
o
u
r
ce
/
d
esti
n
atio
n
I
P,
p
o
r
t
n
u
m
b
er
s
,
p
r
o
t
o
co
l
t
y
p
e,
b
y
te/p
ac
k
et
co
u
n
t,
a
n
d
f
lo
w
d
u
r
atio
n
.
b.
No
r
m
aliza
tio
n
: A
p
p
ly
in
g
Min
-
Ma
x
s
ca
lin
g
to
s
tan
d
ar
d
ize
f
e
atu
r
e
r
an
g
es.
c.
L
ab
el
e
n
co
d
i
n
g
: A
s
s
ig
n
in
g
n
u
m
er
ical
v
alu
es to
class
lab
els (
0
f
o
r
b
en
ig
n
,
1
f
o
r
attac
k
)
.
d.
C
las
s
b
alan
cin
g
:
Utilizin
g
SM
OT
E
f
o
r
m
in
o
r
ity
o
v
er
s
am
p
lin
g
an
d
r
an
d
o
m
u
n
d
er
s
am
p
lin
g
to
h
an
d
le
class
im
b
alan
ce
an
d
p
r
ev
e
n
t m
o
d
el
b
ias.
T
h
is
en
s
u
r
es
th
at
in
p
u
t
d
ata
is
co
n
s
is
ten
t,
n
o
is
e
-
r
ed
u
ce
d
,
an
d
ap
p
r
o
p
r
iately
s
tr
u
ctu
r
ed
f
o
r
n
e
u
r
al
n
etwo
r
k
tr
ain
in
g
.
3
.
5
.
I
m
ple
m
ent
a
t
io
n
env
iro
nm
ent
a
nd
re
pro
du
cibil
it
y
T
h
e
m
o
d
el
is
im
p
lem
en
ted
in
Py
th
o
n
u
s
in
g
t
h
e
T
e
n
s
o
r
Flo
w
f
r
am
ewo
r
k
.
Simu
latio
n
s
ar
e
e
x
ec
u
ted
i
n
a
v
ir
tu
al
SDN
en
v
ir
o
n
m
en
t
u
s
in
g
Min
in
et
v
2
.
3
.
0
an
d
th
e
P
OX
co
n
tr
o
ller
.
DDo
S
attac
k
s
ce
n
ar
io
s
—
in
clu
d
in
g
T
C
P
SYN,
U
DP
f
lo
o
d
,
an
d
I
C
MP
f
lo
o
d
—
ar
e
g
en
er
ate
d
u
s
in
g
h
p
in
g
3
an
d
L
OI
C
to
o
l
s
.
E
x
p
er
im
en
ts
ar
e
co
n
d
u
cte
d
o
n
a
s
y
s
tem
eq
u
i
p
p
ed
with
an
I
n
tel
C
o
r
e
i9
-
1
2
9
0
0
K
p
r
o
ce
s
s
o
r
,
3
2
GB
R
AM
,
an
d
an
NVI
DI
A
R
T
X
3
0
9
0
GPU.
T
r
af
f
ic
is
ca
p
t
u
r
ed
u
s
in
g
W
ir
esh
ar
k
,
an
d
Op
en
Flo
w
s
tatis
tic
s
ar
e
u
s
ed
to
v
alid
ate
an
o
m
aly
d
etec
tio
n
.
T
o
e
n
s
u
r
e
r
e
p
r
o
d
u
c
ib
ilit
y
,
th
e
f
u
ll
m
eth
o
d
o
l
o
g
y
i
s
s
u
p
p
o
r
ted
b
y
p
s
eu
d
o
co
d
e
f
o
r
all
k
ey
alg
o
r
ith
m
s
(
Alg
o
r
ith
m
s
1
–
3
)
,
p
u
b
licly
av
ailab
le
d
atasets
(
I
n
SDN
an
d
Min
in
et
-
g
en
er
ated
tr
a
f
f
ic)
,
an
d
a
d
etailed
r
ec
o
r
d
o
f
h
y
p
er
p
ar
am
eter
s
ettin
g
s
an
d
tr
ain
in
g
co
n
d
itio
n
s
.
4.
E
XP
E
R
I
M
E
N
T
A
L
SE
T
UP
AND
DAT
A
CO
L
L
E
C
T
I
O
N
T
o
e
v
a
l
u
a
t
e
t
h
e
e
f
f
e
c
t
i
v
e
n
ess
o
f
t
h
e
p
r
o
p
o
s
e
d
f
l
o
w
-
g
u
i
d
e
d
L
S
T
M
m
o
d
e
l
w
i
t
h
AD
L
,
a
c
o
m
p
r
e
h
e
n
s
i
v
e
e
x
p
e
r
i
m
e
n
t
a
l
f
r
a
m
e
w
o
r
k
wa
s
d
e
v
e
l
o
p
e
d
,
c
o
m
b
i
n
i
n
g
b
e
n
c
h
m
a
r
k
d
a
t
a
s
e
ts
a
n
d
r
e
a
l
-
ti
m
e
s
i
m
u
la
t
i
o
n
e
n
v
i
r
o
n
m
e
n
t
s
.
T
h
is
s
ec
tio
n
o
u
tlin
es
th
e
d
atasets
u
s
ed
,
attac
k
s
im
u
latio
n
s
tr
ateg
ies,
p
r
ep
r
o
ce
s
s
in
g
p
r
o
ce
d
u
r
es,
m
o
d
el
tr
ain
in
g
co
n
f
ig
u
r
atio
n
s
,
an
d
ev
alu
atio
n
s
ettin
g
s
to
en
s
u
r
e
tr
an
s
p
ar
e
n
c
y
an
d
r
ep
r
o
d
u
cib
ilit
y
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
F
lo
w
-
g
u
id
ed
l
o
n
g
s
h
o
r
t
-
term me
mo
r
y
w
ith
a
d
a
p
tive
d
ir
ec
tio
n
a
l
…
(
Hu
d
a
Mo
h
a
mme
d
I
b
a
d
i
)
5489
4
.
1
.
Da
t
a
c
o
llect
io
n
T
o
ev
alu
ate
th
e
ef
f
ec
tiv
en
ess
an
d
g
en
e
r
aliza
b
ilit
y
o
f
th
e
p
r
o
p
o
s
ed
FDA
–
L
STM
–
ADL
f
r
am
ewo
r
k
,
two
d
is
tin
ct
d
ataset
s
wer
e
u
tili
ze
d
: a
s
tan
d
ar
d
ized
b
en
ch
m
ar
k
d
ataset
an
d
a
cu
s
to
m
r
ea
l
-
tim
e
d
ataset.
T
h
e
f
ir
s
t
d
ataset,
k
n
o
wn
as
th
e
I
n
SDN
d
ataset,
is
a
p
u
b
licly
av
ailab
l
e
b
en
ch
m
a
r
k
s
p
ec
if
ically
cu
r
a
ted
f
o
r
SDN
-
b
ased
in
tr
u
s
io
n
d
etec
tio
n
r
esear
ch
.
I
t
co
n
tain
s
well
-
lab
eled
tr
af
f
ic
s
am
p
les
r
ep
r
esen
tin
g
b
o
th
n
o
r
m
al
an
d
m
alicio
u
s
n
etwo
r
k
b
eh
a
v
io
r
s
,
i
n
clu
d
in
g
a
wid
e
r
an
g
e
o
f
DDo
S
attac
k
s
ce
n
ar
io
s
s
u
ch
as
T
C
P
f
lo
o
d
s
,
UDP
f
lo
o
d
s
,
an
d
I
C
MP
-
b
ased
attac
k
s
[
2
5
]
.
T
h
is
d
ataset
s
er
v
es
as
a
b
aselin
e
f
o
r
co
m
p
ar
ativ
e
ev
alu
ati
o
n
a
g
ain
s
t
ex
is
tin
g
d
etec
tio
n
m
o
d
els.
T
h
e
s
ec
o
n
d
d
ataset
was
cu
s
to
m
-
g
en
e
r
ated
u
s
in
g
Min
i
n
et,
a
n
etwo
r
k
em
u
lato
r
th
at
s
im
u
lates
r
ea
l
-
tim
e
SDN
en
v
ir
o
n
m
en
ts
.
L
ev
er
ag
in
g
th
e
POX
co
n
tr
o
ller
an
d
p
r
o
g
r
am
m
a
b
le
s
witch
to
p
o
lo
g
y
,
d
iv
er
s
e
tr
af
f
i
c
p
atter
n
s
wer
e
ca
p
t
u
r
ed
u
n
d
e
r
b
o
th
b
en
ig
n
an
d
ad
v
e
r
s
ar
ial
c
o
n
d
itio
n
s
,
in
cl
u
d
in
g
d
y
n
am
ic
ally
in
jecte
d
DDo
S
attac
k
s
.
T
h
is
r
ea
l
-
tim
e
d
ataset
allo
ws
f
o
r
a
p
r
ac
tical
ass
ess
m
en
t
o
f
th
e
m
o
d
el’
s
a
d
ap
tab
il
ity
an
d
r
o
b
u
s
tn
ess
in
d
y
n
am
ic
n
etwo
r
k
co
n
d
itio
n
s
,
wh
er
e
tr
af
f
ic
f
lo
ws
an
d
c
o
n
tr
o
ller
r
esp
o
n
s
es
ev
o
lv
e
o
v
er
tim
e
[
2
6
]
.
B
y
em
p
lo
y
in
g
b
o
th
b
en
ch
m
a
r
k
ed
an
d
r
ea
l
-
tim
e
d
atasets
,
th
e
s
tu
d
y
e
n
s
u
r
es
a
c
o
m
p
r
e
h
en
s
iv
e
ev
alu
atio
n
o
f
th
e
p
r
o
p
o
s
ed
m
o
d
el
’
s
p
er
f
o
r
m
an
c
e
ac
r
o
s
s
v
ar
y
in
g
co
n
d
itio
n
s
an
d
tr
af
f
ic
co
m
p
lex
ities
.
T
ab
le
2
p
r
esen
ts
a
co
m
p
a
r
is
o
n
o
f
th
e
two
d
atasets
u
s
ed
f
o
r
tr
ain
in
g
an
d
e
v
alu
atin
g
th
e
p
r
o
p
o
s
ed
DDo
S
d
etec
tio
n
m
o
d
el:
th
e
I
n
SDN
b
en
ch
m
ar
k
d
ataset
an
d
a
cu
s
to
m
r
ea
l
-
tim
e
d
ataset
g
e
n
er
ated
in
Min
in
et.
T
h
e
tab
le
lis
ts
k
ey
f
ea
tu
r
es
ex
tr
ac
ted
f
r
o
m
b
o
th
d
atasets
,
s
u
ch
as
f
lo
w
I
D,
s
o
u
r
ce
an
d
d
esti
n
atio
n
I
P
ad
d
r
ess
es,
p
o
r
t
n
u
m
b
e
r
s
,
p
r
o
t
o
co
l
ty
p
es
(
T
C
P,
UDP,
I
C
M
P),
p
ac
k
et
an
d
b
y
te
co
u
n
ts
,
f
lo
w
d
u
r
atio
n
,
an
d
tr
af
f
ic
ty
p
e
lab
els.
E
ac
h
f
ea
tu
r
e
is
m
ar
k
ed
as
p
r
esen
t
(
✓
)
i
n
b
o
th
d
atasets
,
co
n
f
ir
m
i
n
g
th
at
th
e
e
x
p
er
im
e
n
tal
s
etu
p
m
ain
tain
s
co
n
s
is
ten
cy
in
th
e
f
ea
tu
r
es e
x
tr
ac
ted
ac
r
o
s
s
s
y
n
th
etic
an
d
r
ea
l
-
wo
r
ld
n
etwo
r
k
co
n
d
itio
n
s
.
T
h
is
u
n
if
o
r
m
ity
is
cr
itical
f
o
r
ev
al
u
atin
g
th
e
m
o
d
el’
s
g
en
e
r
aliza
tio
n
ab
ilit
y
.
T
h
e
tab
le
th
u
s
v
alid
ates
th
at
b
o
th
d
atasets
ar
e
r
ich
an
d
well
-
s
tr
u
ctu
r
ed
,
s
u
p
p
o
r
tin
g
ac
cu
r
ate
a
n
d
co
n
s
is
ten
t m
o
d
el
tr
ain
i
n
g
an
d
ev
alu
atio
n
.
T
ab
le
2
.
Su
m
m
a
r
y
o
f
d
atasets
u
s
ed
f
o
r
DDo
S
d
etec
tio
n
F
e
a
t
u
r
e
D
e
scri
p
t
i
o
n
I
n
S
D
N
d
a
t
a
s
e
t
M
i
n
i
n
e
t
d
a
t
a
s
e
t
F
l
o
w
I
D
U
n
i
q
u
e
i
d
e
n
t
i
f
i
e
r
f
o
r
e
a
c
h
n
e
t
w
o
r
k
f
l
o
w
✅
✅
S
o
u
r
c
e
I
P
I
P
a
d
d
r
e
ss
o
f
t
h
e
s
o
u
r
c
e
n
o
d
e
✅
✅
D
e
st
i
n
a
t
i
o
n
I
P
I
P
a
d
d
r
e
ss
o
f
t
h
e
d
e
s
t
i
n
a
t
i
o
n
n
o
d
e
✅
✅
S
o
u
r
c
e
P
o
r
t
P
o
r
t
n
u
mb
e
r
u
se
d
a
t
t
h
e
s
o
u
r
c
e
✅
✅
D
e
st
i
n
a
t
i
o
n
P
o
r
t
P
o
r
t
n
u
mb
e
r
u
se
d
a
t
t
h
e
d
e
s
t
i
n
a
t
i
o
n
✅
✅
P
r
o
t
o
c
o
l
P
r
o
t
o
c
o
l
t
y
p
e
(
T
C
P
,
U
D
P
,
I
C
M
P
)
✅
✅
P
a
c
k
e
t
C
o
u
n
t
N
u
mb
e
r
o
f
p
a
c
k
e
t
s
t
r
a
n
s
mi
t
t
e
d
i
n
a
f
l
o
w
✅
✅
B
y
t
e
C
o
u
n
t
To
t
a
l
b
y
t
e
s
t
r
a
n
smi
t
t
e
d
p
e
r
f
l
o
w
✅
✅
F
l
o
w
D
u
r
a
t
i
o
n
To
t
a
l
d
u
r
a
t
i
o
n
o
f
t
h
e
n
e
t
w
o
r
k
f
l
o
w
✅
✅
Tr
a
f
f
i
c
Ty
p
e
La
b
e
l
e
d
a
s N
o
r
ma
l
o
r
D
D
o
S
A
t
t
a
c
k
✅
✅
4
.
2
.
At
t
a
c
k
s
im
ula
t
io
n
in SDN
env
iro
nm
ent
T
o
r
ep
licate
r
ea
lis
tic
DDo
S c
o
n
d
itio
n
s
,
th
r
ee
m
ajo
r
attac
k
t
y
p
es we
r
e
em
u
lated
:
a.
T
C
P
SYN
f
lo
o
d
in
g
:
Hig
h
-
v
o
lu
m
e
SYN
p
ac
k
ets
wer
e
g
en
er
ated
u
s
in
g
h
p
in
g
3
,
tar
g
etin
g
th
e
SDN
co
n
tr
o
ller
to
ex
h
a
u
s
t its
r
eso
u
r
ce
s
.
b.
UDP
f
lo
o
d
in
g
:
R
an
d
o
m
UDP
p
ac
k
ets
wer
e
d
ir
ec
te
d
to
war
d
s
witch
p
o
r
ts
,
s
atu
r
atin
g
n
et
wo
r
k
lin
k
s
an
d
in
d
u
cin
g
p
ac
k
et
d
r
o
p
s
.
c.
I
C
MP
f
lo
o
d
in
g
:
A
s
tr
ea
m
o
f
I
C
MP
ec
h
o
r
eq
u
ests
(
p
in
g
f
lo
o
d
)
was
u
s
ed
to
o
v
er
lo
ad
t
h
e
co
n
tr
o
ller
’
s
p
r
o
ce
s
s
in
g
ca
p
ac
ity
.
T
h
e
L
OI
C
to
o
l
was
u
s
ed
alo
n
g
s
id
e
h
p
in
g
3
to
in
te
n
s
if
y
tr
af
f
ic
v
o
lu
m
e.
E
ac
h
attac
k
last
ed
ap
p
r
o
x
im
ately
3
0
0
s
ec
o
n
d
s
,
s
im
u
latin
g
a
h
ig
h
-
p
r
ess
u
r
e
in
tr
u
s
io
n
en
v
ir
o
n
m
en
t.
T
h
ese
attac
k
s
wer
e
lau
n
ch
ed
f
r
o
m
m
u
ltip
le
Min
in
et
h
o
s
ts
tar
g
etin
g
SDN
s
witch
es a
n
d
th
e
POX
co
n
tr
o
lle
r
.
4
.
2
.
1
.
At
t
a
c
k
i
m
plem
ent
a
t
io
n
T
o
s
im
u
late
a
r
ea
lis
tic
attac
k
en
v
ir
o
n
m
en
t,
tr
a
f
f
ic
g
e
n
er
ato
r
s
wer
e
d
ep
lo
y
e
d
,
in
cl
u
d
in
g
h
p
in
g
3
(
u
s
ed
o
n
Min
in
et
h
o
s
ts
to
g
en
er
ate
h
ig
h
-
r
ate
T
C
P,
UDP,
an
d
I
C
MP
tr
af
f
ic
f
o
r
DDo
S
s
ce
n
ar
i
o
s
)
an
d
L
OI
C
(
L
o
w
Or
b
it
I
o
n
C
an
n
o
n
,
wh
ich
f
l
o
o
d
s
SDN
co
m
p
o
n
e
n
ts
with
T
C
P/UD
P
p
ac
k
ets).
T
h
e
attac
k
s
tar
g
eted
b
o
t
h
th
e
SDN
co
n
tr
o
ller
,
ca
u
s
in
g
co
n
t
r
o
l
p
lan
e
co
n
g
esti
o
n
,
an
d
S
DN
s
witch
e
s
,
test
in
g
th
eir
r
e
s
ilien
ce
u
n
d
er
h
ig
h
tr
af
f
ic
lo
ad
s
.
E
ac
h
attac
k
last
ed
3
0
0
s
ec
o
n
d
s
(
5
m
in
u
tes),
w
ith
h
p
in
g
3
f
lo
o
d
i
n
g
th
e
n
etwo
r
k
at
1
0
0
0
p
ac
k
ets
p
er
s
ec
o
n
d
an
d
L
OI
C
g
e
n
er
ati
n
g
m
ass
iv
e
T
C
P/UDP tr
af
f
ic
f
lo
o
d
s
tar
g
etin
g
r
an
d
o
m
p
o
r
ts
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
4
8
4
-
5
4
9
6
5490
4
.
2
.
2
.
At
t
a
c
k
s
ce
na
rio
s
T
h
r
ee
DDo
S
attac
k
s
tr
ateg
ies
wer
e
test
ed
:
SYN
Flo
o
d
in
g
,
wh
ich
o
v
e
r
wh
elm
ed
t
h
e
SDN
co
n
tr
o
ller
with
h
ig
h
-
v
o
lu
m
e
T
C
P
SYN
r
eq
u
ests
,
ex
h
au
s
tin
g
its
r
eso
u
r
c
es
an
d
f
o
r
cin
g
it
i
n
to
a
n
u
n
r
es
p
o
n
s
iv
e
s
tate;
UDP
Flo
o
d
in
g
,
wh
e
r
e
lar
g
e
b
u
r
s
ts
o
f
UDP
p
ac
k
ets
tar
g
eted
r
a
n
d
o
m
SDN
s
witch
p
o
r
ts
to
d
ep
l
ete
b
an
d
wid
th
a
n
d
s
atu
r
ate
n
etwo
r
k
lin
k
s
;
an
d
I
C
MP
Flo
o
d
in
g
,
wh
ich
u
s
ed
co
n
tin
u
o
u
s
I
C
MP
ec
h
o
r
eq
u
e
s
ts
(
p
in
g
f
lo
o
d
)
t
o
o
v
er
lo
ad
th
e
SDN
co
n
tr
o
ller
,
co
n
s
u
m
in
g
p
r
o
ce
s
s
in
g
p
o
wer
an
d
d
is
r
u
p
ti
n
g
n
o
r
m
al
o
p
er
ati
o
n
s
.
4
.
2
.
3
.
T
ra
f
f
ic
ca
pture
a
nd
a
t
t
a
ck
a
na
ly
s
is
T
o
an
aly
ze
an
d
v
alid
ate
th
e
i
m
p
ac
t
o
f
DDo
S
attac
k
s
,
W
ir
e
s
h
ar
k
an
d
tcp
d
u
m
p
wer
e
u
s
ed
to
ca
p
tu
r
e
n
etwo
r
k
tr
af
f
ic
p
atter
n
s
,
wh
ile
Op
en
Flo
w
f
lo
w
tab
les
m
o
n
ito
r
ed
SDN
s
witch
es,
tr
ac
k
in
g
p
ac
k
et
d
r
o
p
s
an
d
r
u
le
s
atu
r
atio
n
.
Attack
in
ten
s
ity
was e
v
alu
ated
b
ased
o
n
p
ac
k
et
th
r
o
u
g
h
p
u
t,
laten
cy
,
an
d
d
r
o
p
p
e
d
co
n
n
ec
tio
n
s
.
T
h
e
f
in
d
in
g
s
h
elp
ed
ass
ess
th
e
ef
f
ec
tiv
en
ess
o
f
th
e
Flo
w
-
G
u
id
ed
L
STM
with
ADL
m
o
d
e
l
in
m
itig
atin
g
th
ese
attac
k
s
.
4
.
2
.
4
.
Vis
ua
l
re
presenta
t
io
n o
f
a
t
t
a
c
k
im
pa
ct
T
h
e
im
p
ac
t
o
f
s
im
u
lated
DDo
S
attac
k
s
o
n
th
e
SD
N
n
etwo
r
k
was
ca
p
tu
r
ed
u
s
in
g
v
ar
io
u
s
m
o
n
ito
r
in
g
to
o
ls
.
Min
in
et
ter
m
in
al
o
u
tp
u
t
lo
g
g
ed
attac
k
ex
ec
u
tio
n
,
POX
co
n
tr
o
ller
lo
g
s
tr
ac
k
ed
an
o
m
alo
u
s
ac
tiv
ity
,
W
ir
esh
ar
k
p
r
o
v
id
ed
p
ac
k
et
an
aly
s
is
o
f
h
i
g
h
-
v
o
lu
m
e
tr
a
f
f
ic,
an
d
Op
e
n
Flo
w
f
lo
w
tab
les
r
ev
ea
led
r
u
le
s
atu
r
atio
n
an
d
f
lo
w
h
an
d
lin
g
.
Fig
u
r
e
3
v
is
u
alize
s
th
ese
in
s
ig
h
ts
,
h
ig
h
lig
h
tin
g
th
e
r
ea
l
-
tim
e
ef
f
ec
ts
o
f
attac
k
s
an
d
d
em
o
n
s
tr
atin
g
th
e
Flo
w
-
Gu
id
ed
L
STM
with
ADL
m
o
d
el’
s
ef
f
ec
tiv
en
ess
in
d
etec
tio
n
a
n
d
m
itig
atio
n
.
Fig
u
r
e
3
.
DDo
S
attac
k
im
p
ac
t
o
n
SDN: M
in
in
et,
POX
L
o
g
s
,
W
ir
esh
ar
k
,
an
d
Op
e
n
Flo
w
tab
le
4
.
3
.
E
v
a
lua
t
i
o
n
m
et
rics
T
o
ass
ess
th
e
ef
f
ec
tiv
e
n
ess
an
d
r
eliab
ilit
y
o
f
th
e
p
r
o
p
o
s
ed
m
o
d
el,
s
tan
d
ar
d
ev
alu
atio
n
m
etr
ics
co
m
m
o
n
l
y
u
s
ed
in
class
if
icat
io
n
an
d
an
o
m
aly
d
etec
tio
n
ta
s
k
s
wer
e
em
p
lo
y
ed
.
T
h
ese
m
ea
s
u
r
es
p
r
o
v
id
e
a
q
u
an
titativ
e
g
r
asp
o
f
th
e
m
o
d
el
p
er
f
o
r
m
a
n
ce
,
s
p
ec
if
i
ca
lly
in
b
en
ig
n
/m
alicio
u
s
n
etwo
r
k
b
e
h
av
io
r
d
if
f
er
en
tiatio
n
.
T
h
e
m
o
s
t
co
m
m
o
n
e
v
alu
atio
n
m
etr
ics
i
n
cla
s
s
if
icatio
n
task
is
ac
cu
r
ac
y
,
p
r
ec
is
io
n
,
r
ec
all,
F1
-
s
co
r
e,
th
ey
g
i
v
e
th
e
id
ea
o
f
t
h
e
tr
ad
e
-
o
f
f
in
ce
r
tain
asp
ec
t
s
o
f
t
h
e
class
if
icatio
n
q
u
ality
.
T
h
ese
m
et
r
ics
ar
e
d
ef
in
ed
as f
o
llo
ws:
Acc
u
r
ac
y
(
AC
C
)
: A
s
s
ess
es
th
e
r
atio
o
f
co
r
r
ec
tly
class
if
ied
in
s
tan
ce
s
to
th
e
o
v
er
all
class
if
icatio
n
s
m
ad
e.
=
+
+
+
+
(
1
)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
F
lo
w
-
g
u
id
ed
l
o
n
g
s
h
o
r
t
-
term me
mo
r
y
w
ith
a
d
a
p
tive
d
ir
ec
tio
n
a
l
…
(
Hu
d
a
Mo
h
a
mme
d
I
b
a
d
i
)
5491
Pre
cisi
o
n
(
P):
W
o
r
k
s
o
u
t th
e
p
ar
t o
f
p
o
s
itiv
e
p
r
ed
ictio
n
s
th
at
ar
e
r
ig
h
t.
=
1
∑
(
+
)
(
2
)
R
ec
all
(
s
en
s
itiv
ity
,
tr
u
e
p
o
s
itiv
e
r
ate
-
T
PR
)
: M
ea
s
u
r
es h
o
w
well
th
e
m
o
d
el
id
en
tifie
s
all
p
o
s
itiv
e
in
s
tan
ce
s
.
=
1
∑
(
+
)
(
3
)
F1
-
s
co
r
e
(
p
r
ec
is
io
n
an
d
r
ec
all'
s
h
ar
m
o
n
ic
m
ea
n
)
:
T
h
is
s
co
r
e
is
u
s
ed
wh
en
y
o
u
n
ee
d
a
b
alan
ce
b
etwe
en
p
r
ec
is
io
n
an
d
r
ec
all; it
i
s
esp
ec
ially
u
s
ef
u
l in
s
itu
atio
n
s
wh
en
y
o
u
h
av
e
im
b
alan
ce
d
d
atasets
.
1
=
2
×
(
×
)
+
(
4
)
5.
RE
SU
L
T
S AN
D
D
I
SCU
SS
I
O
N
T
h
is
s
ec
tio
n
p
r
esen
ts
th
e
e
v
al
u
atio
n
r
esu
lts
o
f
th
e
p
r
o
p
o
s
ed
Flo
w
-
Gu
id
ed
L
STM
with
ADL
m
o
d
el,
h
ig
h
lig
h
tin
g
its
d
etec
tio
n
p
er
f
o
r
m
an
ce
o
n
b
o
th
th
e
I
n
SDN
b
en
ch
m
ar
k
d
ataset
an
d
th
e
Min
in
et
-
g
en
er
ated
r
ea
l
-
tim
e
d
ataset.
T
h
e
d
is
cu
s
s
io
n
i
n
clu
d
es
an
in
-
d
ep
t
h
co
m
p
ar
is
o
n
with
s
tate
-
of
-
t
h
e
-
ar
t
m
et
h
o
d
s
,
in
ter
p
r
etatio
n
o
f
r
esu
lts
,
an
d
im
p
licatio
n
s
f
o
r
SDN
-
b
ased
s
ec
u
r
ity
s
y
s
tem
s
.
5
.
1
.
Ano
m
a
ly
det
ec
t
io
n per
f
o
rm
a
nce
Per
f
o
r
m
an
ce
o
f
th
e
m
o
d
el
i
n
ca
p
tu
r
in
g
DDo
S
attac
k
s
was
f
ir
s
t
ev
alu
ated
b
y
co
m
p
ar
in
g
th
e
ca
lcu
lated
an
o
m
al
y
s
co
r
es
wi
th
th
e
tr
u
e
lab
els
o
n
test
s
ets.
An
o
m
aly
s
co
r
es
p
r
o
d
u
ce
d
b
y
L
STM
a
n
d
th
e
g
r
o
u
n
d
tr
u
th
attac
k
s
in
s
tan
ce
s
ar
e
c
o
m
p
a
r
ed
to
ea
c
h
b
etwe
en
n
o
r
m
al
a
n
d
ab
n
o
r
m
al
s
tates
in
Fig
u
r
e
4
w
h
er
e
th
e
b
lu
e
lin
e
r
e
p
r
esen
ts
s
co
r
es
o
f
o
u
r
L
STM
m
o
d
el,
an
d
th
e
r
ed
d
ash
e
d
lin
e
s
h
o
ws
g
r
o
u
n
d
tr
u
t
h
attac
k
in
s
tan
ce
s
.
T
h
e
clo
s
e
co
r
r
esp
o
n
d
en
ce
b
etwe
en
th
e
p
air
r
ef
lects
th
e
m
o
d
el’
s
ab
ilit
y
t
o
ca
p
tu
r
e
tem
p
o
r
al
ab
er
r
atio
n
s
v
er
y
ac
c
u
r
ately
.
Sm
all
d
ev
iatio
n
s
ar
e
th
er
e
b
u
t
it
d
o
es
not
af
f
ec
t
th
e
p
er
f
o
r
m
a
n
ce
in
a
lar
g
e
s
ca
le.
T
h
ese
r
esu
lts
v
alid
ate
th
e
m
o
d
el’
s
ca
p
ac
ity
to
g
e
n
er
alize
to
b
o
th
b
en
ch
m
a
r
k
a
n
d
r
ea
l
-
tim
e
tr
af
f
ic.
T
h
e
in
teg
r
atio
n
o
f
FDA
co
n
tr
ib
u
te
d
to
m
o
r
e
d
is
cr
im
in
ativ
e
f
ea
tu
r
e
r
ep
r
esen
tatio
n
,
wh
ile
ADL
en
ab
led
th
e
m
o
d
el
to
m
ain
tain
r
o
b
u
s
tn
ess
u
n
d
er
e
v
o
lv
in
g
tr
af
f
ic
p
atter
n
s
.
Fig
u
r
e
4
.
L
STM
–
a
n
o
m
al
y
s
co
r
e
v
s
.
g
r
o
u
n
d
tr
u
t
h
lab
els
5
.
2
.
M
ini
net
-
ba
s
ed
SDN
s
im
ula
t
io
n a
nd
net
wo
rk
a
rc
hite
ct
ure
T
h
e
Min
in
et
n
etwo
r
k
to
p
o
lo
g
y
with
th
e
POX
C
o
n
tr
o
ller
r
ef
lects
an
SDN
-
b
ased
ar
ch
itectu
r
e.
I
n
it,
a
ce
n
tr
alize
d
co
n
tr
o
ller
m
an
ag
e
s
tr
af
f
ic
f
lo
w
th
r
o
u
g
h
o
u
t
th
e
n
etwo
r
k
.
Switch
es
h
an
d
le
d
at
a
f
o
r
war
d
in
g
,
an
d
h
o
s
ts
co
m
m
u
n
icate
with
ea
c
h
o
th
er
u
s
in
g
d
y
n
am
ic
r
o
u
ti
n
g
.
T
h
is
to
p
o
lo
g
y
m
ak
es
s
c
alab
ilit
y
,
in
tr
u
s
io
n
d
etec
tio
n
,
a
n
d
s
ec
u
r
ity
p
o
licy
en
f
o
r
ce
m
en
t
am
o
n
g
o
th
er
th
i
n
g
s
m
u
c
h
b
etter
th
an
th
e
alter
n
ativ
e.
An
d
th
o
s
e
m
an
y
im
p
r
o
v
em
e
n
ts
m
ak
e
it
id
ea
l
f
o
r
ex
p
e
r
im
en
tin
g
with
tech
n
iq
u
es
f
r
o
m
t
h
e
n
ascen
t
f
ield
o
f
AI
-
d
r
iv
en
an
o
m
aly
d
etec
tio
n
an
d
f
lo
w
o
p
tim
izatio
n
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
4
8
4
-
5
4
9
6
5492
Fig
u
r
e
5
s
h
o
ws
th
e
SDN
n
et
wo
r
k
to
p
o
l
o
g
y
co
n
s
tr
u
cted
w
ith
in
Min
in
et
an
d
m
an
ag
e
d
b
y
a
POX
co
n
tr
o
ller
.
I
n
th
is
to
p
o
lo
g
y
,
g
r
ee
n
n
o
d
es
d
e
n
o
te
e
n
d
-
h
o
s
ts
,
b
lu
e
n
o
d
es
r
ep
r
esen
t
Op
en
Flo
w
s
witch
es,
an
d
th
e
r
ed
n
o
d
e
s
y
m
b
o
lizes
th
e
c
en
tr
alize
d
SDN
co
n
tr
o
ller
.
T
h
e
f
ig
u
r
e
ca
p
t
u
r
es
th
e
c
o
r
e
s
tr
u
ctu
r
e
an
d
co
m
m
u
n
icatio
n
f
lo
w
o
f
th
e
s
im
u
latio
n
en
v
ir
o
n
m
en
t,
s
h
o
wca
s
in
g
h
o
w
th
e
co
n
tr
o
ller
o
r
ch
estra
tes
p
ac
k
et
r
o
u
tin
g
a
n
d
p
o
licy
en
f
o
r
ce
m
e
n
t
ac
r
o
s
s
th
e
n
etwo
r
k
.
T
h
is
to
p
o
lo
g
y
en
ab
les
d
y
n
am
ic
in
ter
ac
tio
n
am
o
n
g
h
o
s
ts
an
d
s
u
p
p
o
r
ts
th
e
s
im
u
latio
n
o
f
DDo
S scen
ar
io
s
f
o
r
r
ea
l
-
tim
e
d
etec
tio
n
an
aly
s
is
.
Fig
u
r
e
5
.
Min
in
et
n
etwo
r
k
to
p
o
lo
g
y
u
s
in
g
POX
co
n
tr
o
ller
5
.
3
.
F
ina
l
perf
o
rm
a
nce
m
et
r
ics
T
h
is
s
ec
tio
n
p
r
esen
ts
th
e
co
m
p
r
eh
en
s
iv
e
ev
alu
atio
n
o
f
th
e
p
r
o
p
o
s
ed
Hy
b
r
id
L
STM
-
B
ased
Dete
ctio
n
Mo
d
el.
T
h
e
m
o
d
el
was
tr
ain
ed
o
n
th
e
I
n
SDN
d
ataset
an
d
test
ed
in
a
co
n
tr
o
lled
SDN
en
v
ir
o
n
m
en
t
u
s
in
g
Min
in
et
an
d
a
POX
c
o
n
tr
o
lle
r
.
T
h
e
g
o
al
is
to
ass
ess
th
e
m
o
d
el’
s
ab
ilit
y
to
d
etec
t
an
d
class
if
y
m
alicio
u
s
n
etwo
r
k
b
eh
a
v
io
r
s
with
h
ig
h
ac
cu
r
ac
y
an
d
r
eliab
ilit
y
.
Fig
u
r
e
6
is
co
m
p
o
s
ed
o
f
two
s
u
b
f
ig
u
r
es.
Fig
u
r
e
6
(
a)
s
h
o
ws th
e
tr
ain
in
g
an
d
v
alid
atio
n
ac
cu
r
ac
y
cu
r
v
es o
v
er
5
0
e
p
o
ch
s
.
T
h
e
m
o
d
el
d
em
o
n
s
tr
at
es a
s
tab
le
an
d
r
ap
id
co
n
v
er
g
en
ce
,
r
ea
c
h
in
g
h
i
g
h
ac
cu
r
ac
y
b
y
th
e
eig
h
th
e
p
o
ch
,
w
ith
n
o
o
v
er
f
itti
n
g
b
eh
a
v
io
r
o
b
s
er
v
ed
.
Fig
u
r
e
6
(
b
)
d
ep
icts
th
e
r
ec
eiv
er
o
p
e
r
atin
g
ch
ar
ac
ter
is
tic
(
R
OC
)
cu
r
v
e
f
o
r
th
e
p
r
o
p
o
s
ed
m
o
d
el,
in
d
ic
atin
g
an
ar
ea
u
n
d
er
cu
r
v
e
(
AUC)
s
co
r
e
o
f
0
.
9
9
.
T
h
is
n
ea
r
-
p
er
f
ec
t
class
if
icatio
n
p
er
f
o
r
m
an
ce
c
o
n
f
ir
m
s
th
e
m
o
d
el'
s
s
tr
o
n
g
ab
ilit
y
to
d
is
tin
g
u
is
h
b
etwe
en
attac
k
an
d
n
o
r
m
al
tr
af
f
ic.
(
a)
(
b
)
Fig
u
r
e
6
.
C
o
m
p
r
eh
en
s
iv
e
e
v
al
u
atio
n
o
f
th
e
p
r
o
p
o
s
ed
h
y
b
r
id
L
STM
-
b
ased
d
etec
tio
n
m
o
d
el
(
a)
ac
cu
r
ac
y
tr
en
d
s
o
v
er
ep
o
ch
s
an
d
(
b
)
R
OC
cu
r
v
e
o
f
h
y
b
r
id
m
o
d
el
p
er
f
o
r
m
an
c
e
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
F
lo
w
-
g
u
id
ed
l
o
n
g
s
h
o
r
t
-
term me
mo
r
y
w
ith
a
d
a
p
tive
d
ir
ec
tio
n
a
l
…
(
Hu
d
a
Mo
h
a
mme
d
I
b
a
d
i
)
5493
Fig
u
r
e
7
illu
s
tr
ates
th
e
lo
s
s
f
u
n
ctio
n
b
eh
a
v
io
r
d
u
r
in
g
m
o
d
el
tr
ain
in
g
o
n
d
if
f
er
e
n
t
d
atasets
.
Fig
u
r
e
7
(
a
)
c
o
r
r
esp
o
n
d
s
to
th
e
I
n
SDN
b
en
c
h
m
ar
k
d
ataset
an
d
s
h
o
ws
a
co
n
s
is
ten
t
d
ec
r
e
ase
in
tr
ain
in
g
an
d
v
alid
atio
n
l
o
s
s
o
v
er
tim
e,
wi
th
m
in
im
al
d
iv
er
g
en
ce
b
etwe
en
th
e
two
c
u
r
v
es
an
d
Fig
u
r
e
7
(
b
)
illu
s
tr
ates
a
s
im
ilar
tr
en
d
f
o
r
th
e
Min
i
n
et
-
g
en
er
ated
r
ea
l
-
tim
e
d
ataset.
Alth
o
u
g
h
th
e
r
ea
l
-
tim
e
d
ataset
in
itially
ex
h
ib
its
h
ig
h
er
lo
s
s
v
alu
es
d
u
e
to
u
n
p
r
e
d
ictab
le
tr
af
f
ic
p
atter
n
s
,
th
e
m
o
d
el
ev
en
tu
ally
ad
a
p
ts
an
d
c
o
n
v
e
r
g
es,
h
ig
h
lig
h
tin
g
its
r
esil
ien
ce
an
d
g
en
er
aliza
tio
n
ca
p
ac
ity
.
Fig
u
r
e
8
v
is
u
alize
s
th
e
co
n
f
u
s
io
n
m
atr
ices
f
o
r
b
o
th
d
atasets
.
Fig
u
r
e
8
(
a)
d
is
p
lay
s
th
e
cla
s
s
if
icatio
n
o
u
tco
m
es
f
o
r
th
e
I
n
SDN
d
at
aset,
wh
er
e
th
e
m
o
d
el
ac
h
iev
es
h
ig
h
p
r
ec
is
io
n
an
d
r
ec
all,
with
o
n
ly
1
0
f
alse
p
o
s
itiv
es
an
d
5
f
alse
n
eg
ativ
e
s
am
o
n
g
1
,
9
9
0
s
am
p
les.
Fig
u
r
e
8
(
b
)
s
h
o
ws
th
e
r
esu
lts
f
o
r
t
h
e
Min
in
et
d
ataset,
wh
ich
h
as
s
lig
h
tly
m
o
r
e
m
is
class
if
icatio
n
s
—
2
0
f
alse
p
o
s
i
tiv
es
an
d
8
f
alse
n
eg
ativ
es
—
y
et
s
till
m
ain
tain
s
s
tr
o
n
g
o
v
er
all
d
etec
tio
n
p
er
f
o
r
m
an
ce
.
T
h
ese
m
at
r
ices
co
n
f
ir
m
t
h
at
th
e
m
o
d
el
p
er
f
o
r
m
s
r
eliab
ly
in
b
o
th
co
n
tr
o
lled
a
n
d
r
ea
l
-
tim
e
en
v
ir
o
n
m
en
ts
.
(
a)
(
b
)
Fig
u
r
e
7
.
T
h
e
lo
s
s
f
u
n
ctio
n
an
aly
s
is
illu
s
tr
atio
n
(
a)
I
n
SDN
an
d
(
b
)
Min
in
et
d
ataset
(
a)
(
b
)
Fig
u
r
e
8
.
T
h
e
co
n
f
u
s
io
n
m
atr
ix
o
f
h
y
b
r
i
d
L
STM
-
b
ased
m
o
d
el
illu
s
tr
atio
n
(
a)
I
n
SDN
an
d
(
b
)
Min
in
et
d
ataset
I
n
Fig
u
r
e
9
we
s
u
m
m
ar
ize
th
e
f
in
al
p
er
f
o
r
m
a
n
ce
m
etr
ics,
i
n
clu
d
in
g
ac
cu
r
ac
y
,
p
r
ec
is
io
n
,
r
ec
all,
an
d
F1
-
s
co
r
e,
f
o
r
b
o
th
d
atasets
.
T
h
e
v
alu
es
i
n
d
icate
th
at
th
e
m
o
d
el
m
ain
tain
s
a
b
alan
ce
d
p
e
r
f
o
r
m
an
ce
,
with
h
i
g
h
s
co
r
es
ac
r
o
s
s
all
ev
alu
atio
n
m
etr
ics.
T
h
is
s
u
g
g
ests
th
at
t
h
e
in
teg
r
atio
n
o
f
FDA
an
d
ADL
m
ec
h
an
is
m
s
ef
f
ec
tiv
ely
en
h
an
ce
s
d
etec
tio
n
ac
cu
r
ac
y
wh
ile
m
i
n
im
izin
g
f
a
ls
e
alar
m
s
.
T
h
e
ac
cu
r
ac
y
o
f
d
etec
tio
n
o
f
t
h
e
p
r
o
p
o
s
ed
h
y
b
r
id
FDA
–
L
S
T
M
–
ADL
m
o
d
el
is
co
m
p
ar
e
d
with
th
r
ee
r
ec
en
t
s
tate
-
of
-
th
e
-
a
r
t
DDo
S
d
etec
tio
n
ap
p
r
o
ac
h
es,
n
am
e
ly
DDo
SNet,
SNOR
T
-
SD
N,
an
d
DDo
SViT
as
s
h
o
wn
in
T
ab
le
3
.
All
o
f
t
h
e
m
o
d
els
in
th
ese
wo
r
k
s
wer
e
b
ased
o
n
th
eir
o
wn
tr
ai
n
in
g
s
et
s
an
d
ap
p
r
o
a
ch
es
—
lik
e
o
p
tim
izatio
n
-
b
ased
ec
h
o
s
tate
n
etwo
r
k
s
,
m
ac
h
in
e
lear
n
in
g
-
aid
ed
SDN
d
etec
tio
n
,
an
d
tr
an
s
f
o
r
m
er
-
b
ase
d
d
ee
p
lear
n
in
g
m
o
d
els.
Ou
r
p
r
o
p
o
s
ed
m
o
d
el
h
as
ac
cu
r
ac
y
o
f
9
9
.
8
5
%
b
etter
th
an
all
th
e
d
e
tailed
m
eth
o
d
s
a
n
d
test
ed
o
v
er
I
n
SDN
an
d
Min
i
n
et
d
atasets
.
T
h
is
tab
le
also
s
u
p
p
o
r
ts
th
e
em
p
ir
ical
o
b
s
er
v
atio
n
t
h
at
FF
lo
w
Evaluation Warning : The document was created with Spire.PDF for Python.