I
AE
S In
t
er
na
t
io
na
l J
o
urna
l o
f
Art
if
icia
l In
t
ellig
ence
(
I
J
-
AI
)
Vo
l.
1
4
,
No
.
6
,
Dec
em
b
er
2
0
2
5
,
p
p
.
4
7
6
3
~
4
7
7
4
I
SS
N:
2
2
5
2
-
8
9
3
8
,
DOI
: 1
0
.
1
1
5
9
1
/ijai.v
14
.i
6
.
p
p
4
7
6
3
-
4
7
7
4
4763
J
o
ur
na
l ho
m
ep
a
g
e
:
h
ttp
:
//ij
a
i
.
ia
esco
r
e.
co
m
H
y
brid
N
-
g
ra
m
-
b
a
sed framewo
rk
f
o
r pay
lo
a
d
distributed
denia
l of servi
ce
detec
tion a
nd clas
sifica
tion
Andi
M
a
s
la
n
1
,
Cik
F
er
esa
M
o
hd
F
o
o
zy
2
,
K
a
ma
rudd
in M
a
lik
M
o
ha
m
a
d
2
,
Abdu
l H
a
mid
3
,
Dedy
F
it
ria
wa
n
4
,
J
o
ni H
a
s
ug
ia
n
5
1
D
e
p
a
r
t
me
n
t
o
f
I
n
f
o
r
mat
i
c
En
g
i
n
e
e
r
i
n
g
,
F
a
c
u
l
t
y
o
f
En
g
i
n
e
e
r
i
n
g
a
n
d
C
o
m
p
u
t
e
r
S
c
i
e
n
c
e
,
U
n
i
v
e
r
s
i
t
a
s P
u
t
e
r
a
B
a
t
a
m
,
B
a
t
a
m,
I
n
d
o
n
e
s
i
a
2
F
a
c
u
l
t
y
o
f
C
o
mp
u
t
e
r
S
c
i
e
n
c
e
a
n
d
I
n
f
o
r
mat
i
o
n
Te
c
h
n
o
l
o
g
y
,
U
n
i
v
e
r
si
t
i
Tu
n
H
u
sse
i
n
O
n
n
M
a
l
a
y
si
a
,
B
a
t
u
P
a
h
a
t
,
M
a
l
a
y
si
a
3
F
a
c
u
l
t
y
o
f
Te
c
h
n
i
c
a
l
a
n
d
V
o
c
a
t
i
o
n
a
l
Ed
u
c
a
t
i
o
n
,
U
n
i
v
e
r
s
i
t
i
T
u
n
H
u
ssei
n
O
n
n
M
a
l
a
y
s
i
a
,
B
a
t
u
P
a
h
a
t
,
M
a
l
a
y
si
a
4
D
e
p
a
r
t
me
n
t
o
f
R
e
mo
t
e
S
e
n
si
n
g
a
n
d
G
e
o
g
r
a
p
h
i
c
I
n
f
o
r
m
a
t
i
o
n
S
y
st
e
m,
V
o
c
a
t
i
o
n
a
l
S
c
h
o
o
l
,
U
n
i
v
e
r
s
i
t
a
s Ne
g
e
r
i
P
a
d
a
n
g
,
P
a
d
a
n
g
,
I
n
d
o
n
e
s
i
a
5
PT
.
A
n
g
k
a
s
a
P
u
r
a
I
n
d
o
n
e
s
i
a
,
Ja
k
a
r
t
a
,
I
n
d
o
n
e
s
i
a
Art
icle
I
nfo
AB
S
T
RAC
T
A
r
ticle
his
to
r
y:
R
ec
eiv
ed
J
u
n
2
6
,
2
0
2
4
R
ev
is
ed
Sep
2
9
,
2
0
2
5
Acc
ep
ted
Oct
1
6
,
2
0
2
5
Th
e
re
a
re
th
re
e
m
a
in
a
p
p
r
o
a
c
h
e
s
to
d
istr
ib
u
ted
d
e
n
ial
o
f
se
rv
ic
e
(DD
o
S
)
d
e
tec
ti
o
n
:
a
n
o
m
a
ly
-
b
a
se
d
,
p
a
tt
e
r
n
-
b
a
se
d
,
a
n
d
h
e
u
risti
c
-
b
a
se
d
.
Th
e
h
e
u
risti
c
-
b
a
se
d
a
p
p
ro
a
c
h
c
o
m
b
in
e
s
th
e
stre
n
g
th
s
o
f
b
o
th
a
n
o
m
a
ly
a
n
d
p
a
tt
e
r
n
d
e
tec
ti
o
n
.
H
o
we
v
e
r,
e
x
isti
n
g
D
Do
S
d
e
tec
ti
o
n
sy
ste
m
s
stil
l
stru
g
g
le
with
h
y
p
e
rte
x
t
tran
sfe
r
p
r
o
to
c
o
l
(
HTT
P
)
p
a
y
l
o
a
d
-
lev
e
l
a
n
a
l
y
sis
d
u
e
t
o
h
ig
h
fa
lse
p
o
siti
v
e
ra
tes
a
n
d
li
m
it
e
d
d
a
tas
e
t
g
ra
n
u
larit
y
.
T
o
o
v
e
rc
o
m
e
th
e
se
li
m
it
a
ti
o
n
s,
th
is
st
u
d
y
p
r
o
p
o
se
s
a
n
o
v
e
l
h
e
u
risti
c
m
e
th
o
d
b
a
se
d
o
n
a
h
y
b
ri
d
N
-
g
ra
m
m
o
d
e
l
t
h
a
t
i
n
teg
ra
tes
tw
o
k
e
y
c
o
m
p
o
n
e
n
ts:
c
h
i
-
s
q
u
a
r
e
d
istan
c
e
(
CS
D
)
P
a
y
lo
a
d
+N
-
g
ra
m
a
n
d
c
o
s
in
e
sim
il
a
rit
y
(
CS
)
P
a
y
lo
a
d
+N
-
g
ra
m
.
Th
e
CS
DPay
lo
a
d
m
e
a
su
re
s
th
e
d
iffer
e
n
c
e
b
e
twe
e
n
a
g
iv
e
n
p
a
y
l
o
a
d
a
n
d
n
o
rm
a
l
traffic
u
sin
g
th
e
C
S
D
,
wh
i
le
CS
P
a
y
lo
a
d
e
v
a
l
u
a
tes
th
e
ir
sim
il
a
rit
y
u
sin
g
CS
.
Th
e
se
m
e
tri
c
s
fo
rm
a
c
o
m
p
re
h
e
n
siv
e
fe
a
tu
re
se
t
e
v
a
lu
a
ted
o
n
th
re
e
b
e
n
c
h
m
a
rk
d
a
tas
e
ts:
CIC2
0
1
9
,
M
IB
2
0
1
6
,
a
n
d
H2
N
-
P
a
y
lo
a
d
.
T
h
e
m
e
th
o
d
o
lo
g
y
i
n
v
o
lv
e
s
e
x
trac
ti
n
g
HTTP
traffic,
c
o
n
v
e
rti
n
g
it
in
to
h
e
x
a
d
e
c
ima
l
p
a
y
lo
a
d
s,
a
n
d
a
p
p
ly
i
n
g
N
-
g
ra
m
a
n
a
ly
sis
(1
-
t
o
6
-
G
ra
m
)
.
F
re
q
u
e
n
c
y
d
istri
b
u
t
io
n
s
a
re
u
se
d
to
c
a
lcu
la
te
CS
D,
CS
,
a
n
d
P
e
a
r
so
n
’s
c
h
i
-
sq
u
a
re
tes
t
f
o
r
p
a
y
l
o
a
d
c
las
sifica
ti
o
n
.
F
e
a
tu
re
se
lec
ti
o
n
b
a
se
d
o
n
we
ig
h
t
c
o
rre
latio
n
re
fi
n
e
s
th
e
in
p
u
t
f
o
r
m
a
c
h
in
e
lea
rn
in
g
c
las
sifiers
su
p
p
o
rt
v
e
c
to
r
m
a
c
h
in
e
(S
VM),
k
-
n
e
a
re
st
n
e
ig
h
b
o
rs
(KN
N),
a
n
d
n
e
u
ra
l
n
e
tw
o
rk
(NN
)
.
Ex
p
e
rime
n
tal
re
su
lt
s
in
d
ica
te
h
i
g
h
a
c
c
u
ra
c
y
,
p
a
rti
c
u
larly
fo
r
t
h
e
4
-
G
ra
m
m
o
d
e
l:
NN
a
c
h
iev
e
s 9
9
.
6
5
%
,
KN
N 9
5
.
1
4
%
,
a
n
d
S
VM
9
9
.
7
3
%
.
K
ey
w
o
r
d
s
:
C
h
i sq
u
ar
e
C
o
s
in
e
s
im
ilar
ity
DDo
S
Netwo
r
k
Pay
lo
ad
T
h
is i
s
a
n
o
p
e
n
a
c
c
e
ss
a
rticle
u
n
d
e
r th
e
CC B
Y
-
SA
li
c
e
n
se
.
C
o
r
r
e
s
p
o
nd
ing
A
uth
o
r
:
An
d
i M
aslan
Dep
ar
tm
en
t o
f
I
n
f
o
r
m
atic
E
n
g
in
ee
r
in
g
,
Facu
lty
o
f
E
n
g
in
ee
r
i
n
g
an
d
C
o
m
p
u
ter
Scien
ce
Un
iv
er
s
itas
Pu
ter
a
B
atam
T
em
b
esi,
Kep
u
lau
an
R
iau
,
B
atam
,
I
n
d
o
n
esia
E
m
ail:
L
an
m
asco
@
g
m
ail.
co
m
1.
I
NT
RO
D
UCT
I
O
N
Dis
tr
ib
u
ted
d
en
ial
o
f
s
er
v
ice
(
DDo
S
)
attac
k
s
h
as
p
er
s
is
ted
f
o
r
d
ec
ad
es.
I
n
th
e
p
ast,
s
u
ch
attac
k
s
o
f
ten
o
r
ig
in
ated
f
r
o
m
a
lim
ited
n
u
m
b
er
o
f
s
o
u
r
ce
s
,
wh
ich
co
u
l
d
b
e
ef
f
ec
tiv
ely
m
itig
ated
u
s
i
n
g
s
p
ec
if
ic
d
ef
e
n
s
e
m
ec
h
an
is
m
s
—
ty
p
ically
b
y
b
lo
ck
in
g
o
r
d
en
y
in
g
ac
ce
s
s
f
r
o
m
th
o
s
e
id
en
tifie
d
s
o
u
r
ce
s
,
esp
ec
ially
wh
en
en
h
an
ce
d
tr
ac
ea
b
ilit
y
was
av
a
ilab
le.
Ho
wev
er
,
with
th
e
ex
p
o
n
en
tial
g
r
o
wth
o
f
th
e
in
ter
n
e
t,
m
o
d
er
n
s
y
s
tem
s
h
av
e
b
ec
o
m
e
in
cr
ea
s
in
g
ly
v
u
ln
er
ab
le.
T
h
e
s
h
ee
r
v
o
lu
m
e
o
f
s
im
u
ltan
eo
u
s
d
ata
ac
ce
s
s
r
eq
u
ests
d
ir
ec
ted
at
s
er
v
er
s
is
n
o
w
d
if
f
icu
lt
to
m
an
ag
e,
cr
ea
tin
g
o
p
p
o
r
t
u
n
ities
f
o
r
attac
k
er
s
to
o
v
er
wh
el
m
o
r
b
y
p
ass
s
er
v
er
d
ef
en
s
es,
wh
eth
er
d
eli
b
er
ately
o
r
in
ad
v
er
ten
tly
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
2
5
2
-
8
9
3
8
I
n
t J Ar
tif
I
n
tell
,
Vo
l.
1
4
,
No
.
6
,
Dec
em
b
er
2
0
2
5
:
4
7
6
3
-
4
7
7
4
4764
T
h
r
ee
m
eth
o
d
s
ar
e
o
f
ten
e
m
p
lo
y
ed
i
n
d
etec
tin
g
DDo
S
at
tack
s
:
DDo
S
d
etec
tio
n
ap
p
r
o
ac
h
es
ar
e
g
en
er
ally
ca
te
g
o
r
ized
in
to
th
r
ee
ty
p
es:
p
atter
n
-
b
ased
,
an
o
m
aly
-
b
ased
,
a
n
d
h
eu
r
is
tic
-
b
ased
m
eth
o
d
s
.
E
ac
h
o
f
th
ese
tech
n
iq
u
es
h
as
its
o
wn
s
tr
en
g
th
s
an
d
lim
itatio
n
s
,
m
e
an
in
g
t
h
at
n
o
s
in
g
le
m
eth
o
d
o
f
f
er
s
a
u
n
i
v
er
s
ally
o
p
tim
al
o
r
d
ef
i
n
itiv
e
s
o
lu
tio
n
.
Sp
ec
if
ically
,
p
atter
n
-
b
ased
d
etec
tio
n
wo
r
k
s
b
y
co
m
p
a
r
in
g
s
eq
u
en
ce
s
o
f
d
at
a
p
ac
k
ets
tr
av
er
s
in
g
a
n
etwo
r
k
ag
ain
s
t
a
p
r
ed
ef
in
ed
s
et
o
f
r
u
les
o
r
k
n
o
wn
m
alicio
u
s
p
ay
lo
ad
p
atter
n
s
.
T
h
is
m
eth
o
d
is
q
u
ite
p
o
wer
f
u
l
f
o
r
p
r
ev
io
u
s
ly
r
ec
o
g
n
ized
atta
ck
s
,
wh
ich
ar
e
s
till
o
f
ten
u
s
ed
to
d
ay
[
1
]
.
T
h
e
d
is
ad
v
an
tag
e
o
f
th
is
p
atter
n
-
b
ased
m
eth
o
d
is
th
at
if
th
e
in
c
o
m
in
g
attac
k
h
as
n
ev
er
ex
is
te
d
o
r
th
e
lis
t
o
f
r
u
les
u
s
ed
h
as n
o
t
ch
an
g
ed
f
o
r
to
o
l
o
n
g
,
it
ca
n
n
o
t
d
etec
t
th
e
latest attac
k
s
.
T
h
en
,
th
e
d
etec
tio
n
ac
cu
r
ac
y
lev
el
is
s
till
lo
w,
n
am
ely
9
5
%,
wh
ich
ca
n
s
till
b
e
im
p
r
o
v
e
d
[
2
]
.
T
h
en
,
Ald
wair
i
et
a
l.
[
3
]
p
r
o
p
o
s
ed
a
DDo
S
attac
k
d
etec
ti
o
n
m
eth
o
d
b
ased
o
n
p
ay
lo
ad
s
im
ilar
ity
,
em
p
lo
y
in
g
a
s
im
ilar
ity
-
b
ased
class
if
icatio
n
ap
p
r
o
ac
h
.
I
n
a
r
elate
d
s
tu
d
y
,
Ma
s
u
d
et
a
l.
[
4
]
in
tr
o
d
u
ce
d
a
f
ea
tu
r
e
s
elec
tio
n
tech
n
iq
u
e
u
s
in
g
in
f
o
r
m
atio
n
g
ain
to
en
h
an
ce
d
et
ec
tio
n
ac
cu
r
ac
y
,
co
m
b
in
ed
w
ith
a
r
an
d
o
m
f
o
r
est
class
if
ier
th
at
ac
h
iev
ed
a
d
et
ec
tio
n
ac
cu
r
ac
y
o
f
9
9
.
0
6
%
an
d
a
lo
w
f
alse
alar
m
r
ate
o
f
0
.
0
9
4
.
Me
an
w
h
ile,
Z
ah
id
an
d
B
h
ar
ati
[
5
]
p
r
esen
t
ed
a
h
y
b
r
i
d
ap
p
r
o
ac
h
to
p
r
o
ce
s
s
s
tr
ea
m
in
g
n
etwo
r
k
p
ac
k
ets
an
d
class
if
y
DDo
S
attac
k
s
,
r
ep
o
r
tin
g
h
y
b
r
id
d
e
ep
lear
n
in
g
m
o
d
el
(
C
NN
-
B
iLST
M)
an
ac
cu
r
ac
y
o
f
9
9
.
9
%
.
Fu
r
th
er
m
o
r
e,
Ma
s
u
d
et
a
l.
[
4
]
h
ig
h
lig
h
te
d
th
at
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
tem
s
(
I
DS)
ar
e
ef
f
ec
tiv
e
f
o
r
attac
k
d
etec
tio
n
,
as
th
ey
ca
n
id
en
tify
s
u
s
p
icio
u
s
b
eh
a
v
io
r
,
an
o
m
alo
u
s
tr
af
f
ic
p
atter
n
s
,
an
d
ev
e
n
p
r
ev
io
u
s
ly
u
n
k
n
o
wn
attac
k
ty
p
es
—
p
ar
ticu
lar
ly
th
o
s
e
ex
p
l
o
itin
g
s
y
n
ch
r
o
n
ize
(
SYN
)
p
ac
k
ets,
wh
ich
allo
w
th
e
s
y
s
tem
to
d
etec
t
d
is
cr
ep
an
cies
b
etwe
en
d
ata
p
ac
k
ets tr
an
s
m
itted
o
v
er
t
h
e
n
etwo
r
k
.
Ad
d
itio
n
ally
,
B
in
d
r
a
a
n
d
So
o
d
[
6
]
i
n
v
esti
g
ated
th
e
in
f
lu
en
c
e
o
f
f
ea
tu
r
e
s
elec
tio
n
o
n
th
e
p
er
f
o
r
m
a
n
ce
o
f
m
ac
h
in
e
lear
n
in
g
m
o
d
els
in
DDo
S
d
etec
tio
n
.
I
t
co
n
clu
d
ed
th
at
s
ig
n
atu
r
e
-
b
ased
d
e
f
en
s
e
m
ec
h
an
is
m
s
ar
e
in
ad
eq
u
ate
ag
ain
s
t
ev
o
lv
in
g
th
r
ea
ts
lik
e
DDo
S
attac
k
s
.
As
em
p
h
asized
in
[
7
]
,
th
e
co
r
e
o
b
jectiv
e
o
f
d
ev
elo
p
in
g
a
m
ac
h
in
e
lear
n
in
g
class
if
ier
i
s
to
d
etec
t
DDo
S
attac
k
s
b
o
th
ef
f
icien
tly
an
d
ef
f
ec
tiv
ely
.
Ho
wev
er
,
m
o
d
el
p
er
f
o
r
m
a
n
ce
h
ea
v
ily
d
ep
en
d
s
o
n
th
e
s
elec
tio
n
o
f
r
el
ev
an
t
f
ea
tu
r
es
f
r
o
m
n
etwo
r
k
tr
af
f
ic.
T
h
e
r
esear
c
h
ev
alu
ated
8
4
s
tan
d
a
r
d
f
ea
tu
r
es
u
s
in
g
s
ev
e
r
al
m
ac
h
i
n
e
lear
n
in
g
class
if
ier
s
—
in
clu
d
in
g
s
u
p
p
o
r
t
v
ec
to
r
m
ac
h
in
e
(
SVM)
,
Gau
s
s
ian
n
aiv
e
B
ay
es
(
GNB),
k
-
n
ea
r
est
n
eig
h
b
o
r
s
(
KNN)
,
an
d
r
an
d
o
m
f
o
r
est
.
Am
o
n
g
th
ese,
KNN
ac
h
iev
ed
9
4
% a
cc
u
r
ac
y
with
1
5
-
f
o
ld
c
r
o
s
s
-
v
alid
atio
n
,
w
h
ile
r
an
d
o
m
f
o
r
est
y
ield
e
d
th
e
h
ig
h
est p
er
f
o
r
m
an
ce
at
9
6
% a
cc
u
r
ac
y
.
At
th
e
m
o
m
en
t,
DDo
S
is
a
k
i
n
d
o
f
cy
b
e
r
attac
k
th
at
ca
n
ta
r
g
et
an
y
web
s
ite,
in
clu
d
in
g
t
h
o
s
e
o
p
er
ated
b
y
b
u
s
in
ess
es,
s
ch
o
o
ls
,
in
d
i
v
id
u
als,
an
d
o
n
lin
e
r
etailer
s
.
T
h
e
attac
k
s
also
k
ee
p
ch
a
n
g
i
n
g
in
tan
d
em
with
tech
n
o
lo
g
ical
ad
v
a
n
ce
m
en
ts
.
L
ay
er
s
two
t
h
r
o
u
g
h
s
ev
en
ar
e
th
e
attac
k
tar
g
et
s
in
ce
th
is
is
wh
er
e
th
e
s
er
v
er
lo
ad
s
th
e
web
p
ag
e
an
d
r
esp
o
n
d
s
to
h
y
p
er
tex
t
tr
an
s
f
er
p
r
o
to
co
l
(
HT
T
P)
r
eq
u
ests
.
B
ec
a
u
s
e
it
m
im
ics
r
ea
l
o
n
lin
e
tr
af
f
ic,
th
is
ty
p
e
o
f
atta
ck
is
o
f
ten
h
a
r
d
to
r
ec
o
g
n
ize
a
n
d
co
u
n
ter
.
Kim
et
a
l.
[
8
]
h
av
e
e
x
p
r
ess
ed
o
n
g
o
in
g
co
n
ce
r
n
s
r
eg
ar
d
in
g
tr
af
f
ic
an
aly
s
is
m
eth
o
d
s
th
at
r
ely
s
o
lely
o
n
s
tatis
tical
m
etr
ics
—
s
u
ch
as
p
ac
k
et
c
o
u
n
t,
s
ize,
an
d
tr
a
n
s
m
is
s
io
n
d
u
r
atio
n
.
T
r
ad
itio
n
al
ly
,
DDo
S
d
etec
tio
n
in
v
o
lv
es
ag
g
r
eg
atin
g
in
d
iv
id
u
al
p
ac
k
ets
in
to
n
etwo
r
k
f
lo
ws
b
ased
o
n
t
h
e
f
iv
e
-
tu
p
le:
s
o
u
r
ce
I
P,
s
o
u
r
ce
p
o
r
t,
d
esti
n
atio
n
I
P,
d
esti
n
atio
n
p
o
r
t,
a
n
d
tr
an
s
p
o
r
t
-
lay
er
p
r
o
to
co
l.
Ho
wev
e
r
,
HT
T
P
-
b
ased
DDo
S
attac
k
s
h
av
e
r
ec
eiv
ed
co
m
p
ar
ativ
ely
less
atten
tio
n
b
ec
au
s
e
th
eir
d
etec
tio
n
o
f
ten
r
eq
u
ir
es
in
s
p
ec
tin
g
p
ay
lo
ad
c
o
n
ten
t,
wh
ich
is
o
n
ly
ac
ce
s
s
ib
le
af
ter
f
lo
w
co
m
p
letio
n
.
T
h
is
in
tr
o
d
u
ce
s
ad
d
itio
n
al
c
o
m
p
u
tatio
n
al
o
v
er
h
ea
d
wh
en
ex
tr
ac
tin
g
s
tatis
tical
f
ea
tu
r
es f
r
o
m
f
lo
ws.
W
h
ile
ex
is
tin
g
m
eth
o
d
s
ca
n
i
d
en
tify
b
o
th
b
a
n
d
wid
th
-
an
d
r
eso
u
r
ce
-
d
e
p
letio
n
DDo
S
attac
k
s
,
m
o
s
t
f
o
cu
s
p
r
im
ar
ily
o
n
b
an
d
wid
th
-
r
elate
d
in
d
icato
r
s
—
s
u
ch
as
th
e
v
o
lu
m
e
an
d
s
ize
o
f
in
co
m
in
g
/
o
u
tg
o
i
n
g
p
ac
k
ets
—
lead
in
g
to
h
ig
h
f
a
ls
e
p
o
s
itiv
e
r
ates.
T
o
ad
d
r
ess
th
ese
lim
itatio
n
s
,
[
6
]
p
r
o
p
o
s
ed
ap
p
r
o
ac
h
es
lev
er
ag
in
g
s
tatis
tical
an
aly
s
is
o
f
d
atasets
f
r
o
m
th
e
m
a
n
ag
e
m
en
t
in
f
o
r
m
atio
n
b
ase
(
MI
B
)
an
d
th
e
C
an
ad
ian
I
n
s
titu
te
f
o
r
C
y
b
er
s
ec
u
r
ity
(
C
I
C
)
.
Mo
r
e
r
ec
en
tly
,
o
th
er
s
t
u
d
ies
[
9
]
–
[
1
1
]
h
av
e
em
p
lo
y
e
d
m
ac
h
in
e
lea
r
n
in
g
tech
n
iq
u
es
to
d
etec
t
n
etwo
r
k
in
tr
u
s
io
n
s
an
d
an
o
m
alies.
I
n
p
ar
ticu
lar
,
W
an
g
et
a
l.
[
1
2
]
co
n
d
u
cted
a
co
m
p
r
eh
e
n
s
iv
e
r
e
v
iew
o
f
a
n
o
m
aly
d
etec
tio
n
m
eth
o
d
s
u
s
i
n
g
th
e
MI
B
2
0
1
6
an
d
C
I
C
2
0
1
7
d
atasets
,
wh
ile
Ma
n
n
a
an
d
Alk
asas
s
b
eh
[
1
3
]
in
tr
o
d
u
ce
d
a
n
ew
d
ataset
in
c
o
r
p
o
r
ati
n
g
m
o
d
er
n
attac
k
v
ec
to
r
s
n
o
t
p
r
ev
i
o
u
s
ly
co
v
er
ed
i
n
th
e
liter
atu
r
e.
T
h
eir
m
eth
o
d
o
lo
g
y
u
tili
ze
s
9
1
MI
B
-
d
er
iv
ed
tr
af
f
ic
f
ea
tu
r
es
g
r
o
u
p
ed
in
t
o
f
iv
e
p
r
o
to
co
l
ca
teg
o
r
ies
:
in
ter
n
et
p
r
o
to
co
l
(
IP
)
,
in
ter
n
et
c
o
n
tr
o
l
m
ess
ag
e
p
r
o
to
co
l
(
I
C
MP
)
,
tr
an
s
m
is
s
io
n
co
n
tr
o
l
p
r
o
to
co
l
(
T
C
P
)
,
u
s
er
d
atag
r
am
p
r
o
to
c
o
l
(
UDP
)
,
a
n
d
s
im
p
le
n
etwo
r
k
m
an
a
g
em
en
t
p
r
o
t
o
co
l
(
SNMP
)
;
co
llected
p
er
io
d
ically
f
r
o
m
b
o
t
h
attac
k
s
o
u
r
ce
s
an
d
tar
g
et
s
y
s
tem
s
.
T
h
e
ex
p
er
im
e
n
tal
s
etu
p
in
clu
d
e
d
th
r
ee
co
n
tr
o
lled
DDo
S a
ttack
ty
p
es: Pin
g
Flo
o
d
,
T
ar
g
a
3
,
an
d
UDP
Flo
o
d
[
9
]
.
Desp
ite
th
ese
ad
v
an
ce
s
,
p
att
er
n
-
b
ased
d
etec
tio
n
in
I
DS
f
ac
es
two
k
ey
ch
allen
g
es.
First,
DDo
S
attac
k
s
ar
e
r
elativ
ely
ea
s
y
to
lau
n
ch
a
n
d
d
if
f
icu
lt
to
t
r
ac
e
d
u
e
to
in
h
er
en
t
lim
itatio
n
s
in
t
h
e
T
C
P/IP
p
r
o
to
co
l
s
u
ite,
wh
ich
attac
k
er
s
e
x
p
lo
it
t
o
o
b
s
cu
r
e
v
ictim
i
d
en
tific
atio
n
[
1
4
]
.
Mo
r
eo
v
e
r
,
m
o
d
er
n
DDo
S
tactics
—
s
u
ch
as
SYN
-
Flo
o
d
attac
k
s
—
f
u
r
th
er
co
m
p
licate
d
etec
tio
n
.
A
s
in
g
l
e
SYN
p
ac
k
et
is
ty
p
ically
in
d
is
tin
g
u
is
h
ab
le
f
r
o
m
leg
itima
te
tr
af
f
ic,
m
a
k
in
g
it
h
ar
d
f
o
r
I
DS
to
f
lag
s
u
ch
ac
tiv
ity
as
an
o
m
al
o
u
s
.
C
o
n
s
eq
u
en
tly
,
SYN
-
Flo
o
d
attac
k
s
o
f
ten
ev
ad
e
ea
r
ly
war
n
in
g
s
y
s
tem
s
.
Seco
n
d
,
s
ig
n
atu
r
e
-
b
ased
I
DS
f
r
eq
u
e
n
tly
g
en
er
ate
f
alse
p
o
s
itiv
es
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J Ar
tif
I
n
tell
I
SS
N:
2252
-
8
9
3
8
Hyb
r
id
N
-
g
r
a
m
-
b
a
s
ed
fr
a
mewo
r
k
fo
r
p
a
ylo
a
d
DDo
S
d
etec
t
io
n
…
(
A
n
d
i Ma
s
la
n
)
4765
wh
en
n
o
r
m
al
n
etwo
r
k
b
eh
a
v
io
r
is
m
is
clas
s
if
ied
as m
alicio
u
s
[
2
]
.
Giv
en
th
ese
ch
allen
g
es,
ti
m
ely
d
etec
tio
n
an
d
r
ap
id
d
ep
lo
y
m
en
t
o
f
m
itig
ati
o
n
s
tr
ateg
ies
ar
e
cr
itical
to
p
r
eser
v
in
g
n
etwo
r
k
av
ailab
ilit
y
an
d
f
u
n
ctio
n
ality
d
u
r
in
g
DDo
S in
cid
en
ts
.
T
h
en
,
Swap
n
a
an
d
Pra
s
ad
[
1
5
]
p
r
o
p
o
s
ed
a
s
tu
d
y
u
s
in
g
th
e
N
-
g
r
am
m
eth
o
d
to
ex
am
in
e
t
h
e
n
etwo
r
k
tr
af
f
ic
f
lo
w
h
ea
d
er
.
Selectio
n
o
f
th
e
b
est
f
ea
tu
r
es
u
s
in
g
t
h
e
ch
i
-
s
q
u
ar
e
test
aim
s
to
k
n
o
w
th
e
s
ig
n
if
ican
t
r
elatio
n
s
h
ip
b
etwe
en
th
e
two
v
ar
iab
les
b
ein
g
co
m
p
ar
e
d
.
At
th
e
s
am
e
tim
e,
d
eter
m
in
in
g
t
h
e
o
r
d
er
o
f
f
ea
tu
r
es
u
s
in
g
an
alg
o
r
ith
m
b
ased
o
n
th
e
o
r
d
e
r
o
f
N
-
g
r
am
t
o
g
et
m
ea
n
in
g
f
u
l
f
ea
tu
r
es
f
r
o
m
th
e
s
em
an
tics
o
f
tr
af
f
i
c
f
lo
w.
I
n
a
d
d
itio
n
to
d
etec
tin
g
m
alwa
r
e,
th
is
m
eth
o
d
ca
n
also
d
etec
t
DDo
S
attac
k
s
th
at
f
o
cu
s
o
n
th
e
HT
T
P
p
r
o
to
co
l,
wh
eth
e
r
web
-
b
ased
o
r
attac
k
s
o
n
m
o
b
ile
n
etwo
r
k
s
.
T
h
e
r
esu
lts
d
em
o
n
s
tr
ate
th
e
s
o
lu
tio
n
's
ef
f
icien
cy
,
an
d
a
tr
ain
ed
m
o
d
el
ca
n
id
en
tify
m
alicio
u
s
attac
k
s
with
m
u
ltip
le
f
alse
war
n
i
n
g
s
.
T
h
e
d
etec
tio
n
ac
cu
r
ac
y
r
ate
is
9
9
.
1
5
%,
b
u
t
t
h
e
f
alse
p
o
s
itiv
e
is
0
.
4
5
%.
I
t
c
an
d
etec
t
5
4
.
8
1
%
o
f
m
alicio
u
s
ap
p
licatio
n
s
wh
en
u
s
ed
in
a
r
ea
l e
n
v
ir
o
n
m
en
t,
w
h
ich
is
b
etter
th
an
o
th
er
p
o
p
u
lar
an
ti
-
v
ir
u
s
s
ca
n
n
e
r
s
.
Fro
m
th
e
b
ac
k
g
r
o
u
n
d
o
f
t
h
e
p
r
o
b
lem
an
d
th
e
m
o
tiv
atio
n
o
f
th
e
r
esear
ch
,
N
-
g
r
am
-
b
ased
p
a
y
lo
ad
-
lev
el
d
etec
tio
n
is
an
ap
p
r
o
ac
h
th
at
u
tili
ze
s
th
e
an
al
y
s
is
o
f
t
h
e
p
a
y
lo
ad
co
n
te
n
t
o
f
n
etwo
r
k
p
ac
k
ets
to
d
etec
t
DDo
S
attac
k
p
atter
n
s
,
esp
ec
ia
lly
at
th
e
a
p
p
licatio
n
lay
er
(
lay
er
7
)
.
T
h
is
tech
n
iq
u
e
p
e
r
f
o
r
m
s
f
ea
tu
r
e
e
x
tr
ac
tio
n
b
ased
o
n
a
s
eq
u
en
ce
o
f
ch
a
r
ac
ter
s
o
r
b
y
tes
(
N
-
g
r
am
)
i
n
a
p
a
y
lo
ad
.
W
h
ich
is
th
en
u
s
ed
to
d
is
tin
g
u
is
h
b
etwe
en
n
o
r
m
al
tr
af
f
ic
an
d
o
f
f
e
n
s
iv
e
tr
af
f
ic.
Fu
r
th
er
m
o
r
e
,
N
-
g
r
am
is
h
eu
r
i
s
tic
-
b
ased
,
wh
er
e
th
e
p
r
o
ce
s
s
o
f
to
k
en
izin
g
th
e
p
ay
lo
ad
in
to
N
-
g
r
am
is
co
m
b
in
ed
with
r
u
les
o
r
p
atter
n
s
d
esig
n
ed
b
ased
o
n
d
o
m
ain
k
n
o
wled
g
e
an
d
m
alicio
u
s
tr
a
f
f
ic
ch
ar
ac
ter
is
tics
.
Heu
r
is
tics
ar
e
u
s
ed
to
f
ilter
an
d
em
p
h
asize
s
p
ec
if
ic
N
-
g
r
a
m
s
th
at
h
av
e
h
ig
h
r
elev
an
ce
to
attac
k
b
eh
av
i
o
r
,
s
o
th
at
th
ey
ca
n
im
p
r
o
v
e
d
et
ec
tio
n
ef
f
icien
c
y
a
n
d
ac
cu
r
ac
y
with
o
u
t
r
ely
in
g
e
n
tire
ly
o
n
s
tatis
tical
lear
n
in
g
m
eth
o
d
s
o
r
c
o
m
p
lex
class
if
i
ca
tio
n
m
o
d
els.
W
h
ile
th
e
th
i
r
d
s
tag
e,
h
eu
r
is
tic
an
d
h
y
b
r
i
d
tech
n
iq
u
es,
is
an
ap
p
r
o
ac
h
th
at
c
o
m
b
in
es
r
u
l
e
-
b
ased
m
eth
o
d
s
with
m
ac
h
in
e
lear
n
in
g
tech
n
iq
u
es
to
in
cr
ea
s
e
d
etec
tio
n
ef
f
ec
tiv
en
ess
.
Heu
r
is
tic
tech
n
iq
u
es
in
th
is
co
n
tex
t
r
e
f
er
to
th
e
u
s
e
o
f
d
o
m
ain
k
n
o
wled
g
e
an
d
k
n
o
wn
attac
k
b
eh
av
io
r
p
atter
n
s
t
o
f
o
r
m
in
i
tial
d
etec
tio
n
r
u
les,
s
u
c
h
as
r
ec
o
g
n
izin
g
ab
n
o
r
m
al
f
r
eq
u
en
cies
o
f
a
p
a
r
ticu
lar
N
-
g
r
am
o
r
p
ay
l
o
ad
s
tr
u
ctu
r
es th
at
d
ev
iate
f
r
o
m
n
o
r
m
al
tr
a
f
f
i
c.
Me
an
wh
ile,
th
e
h
y
b
r
id
ap
p
r
o
ac
h
in
teg
r
ates
h
eu
r
is
tics
with
lear
n
in
g
alg
o
r
ith
m
s
,
b
o
t
h
s
eq
u
en
tially
(
h
eu
r
is
tic
as
a
p
r
e
-
p
r
o
ce
s
s
in
g
s
tag
e
b
ef
o
r
e
class
if
icatio
n
)
an
d
p
ar
allel
(
th
e
r
esu
lts
o
f
h
eu
r
i
s
tics
an
d
s
tatis
tical
m
o
d
els
ar
e
co
m
b
i
n
ed
f
o
r
d
e
cisi
o
n
-
m
ak
in
g
)
.
T
h
is
co
m
b
i
n
atio
n
aim
s
to
o
v
er
co
m
e
th
e
lim
itatio
n
s
o
f
ea
ch
m
eth
o
d
,
wh
e
r
e
h
eu
r
is
tics
ex
ce
l
in
q
u
ick
d
etec
tio
n
an
d
e
x
p
lic
it
k
n
o
wled
g
e
-
b
ased
,
wh
ile
m
a
ch
in
e
lear
n
in
g
h
as
th
e
ad
v
a
n
tag
e
o
f
ca
p
tu
r
in
g
co
m
p
lex
p
atter
n
s
an
d
g
en
er
alizi
n
g
to
n
ew
attac
k
v
ar
iatio
n
s
.
B
y
u
tili
zin
g
h
eu
r
is
tic
an
d
h
y
b
r
id
tec
h
n
iq
u
es,
th
e
d
et
ec
tio
n
s
y
s
tem
is
ab
le
to
ca
r
r
y
o
u
t e
ar
ly
id
e
n
tific
atio
n
o
f
s
u
s
p
icio
u
s
tr
af
f
ic,
wh
ile
in
cr
ea
s
in
g
ac
cu
r
ac
y
r
ates
an
d
lo
wer
in
g
f
alse
p
o
s
itiv
e
r
ates.
T
h
is
s
tr
ateg
y
is
p
ar
ticu
lar
ly
r
elev
an
t
in
d
y
n
am
ic
DDo
S a
ttack
s
ce
n
ar
io
s
,
wh
er
e
attac
k
p
atter
n
s
ca
n
b
e
f
ick
le
a
n
d
d
if
f
ic
u
lt to
d
etec
t w
ith
a
s
in
g
le
ap
p
r
o
ac
h
.
2.
M
E
T
H
O
D
T
h
is
s
tu
d
y
em
p
lo
y
s
a
h
e
u
r
is
tic
-
b
ased
N
-
g
r
am
tech
n
iq
u
e
f
o
r
DDo
S
attac
k
d
etec
tio
n
.
T
h
e
r
esear
ch
b
eg
in
s
with
th
e
co
llectio
n
o
f
th
r
ee
d
atasets
:
C
I
C
2
0
1
9
[
1
6
]
,
[
1
7
]
,
MI
B
2
0
1
6
[
1
8
]
,
a
n
d
a
n
ewly
g
e
n
er
ated
d
ataset
d
er
iv
ed
f
r
o
m
a
s
im
u
lated
DDo
S
attac
k
u
s
in
g
a
cu
s
to
m
-
b
u
ilt
to
o
l
n
am
e
d
Ham
m
er
Ma
s
ter
,
im
p
lem
en
ted
in
a
p
r
o
g
r
am
m
in
g
lan
g
u
ag
e
(
r
ef
er
r
ed
to
as
H2
N
-
P
ay
lo
ad
)
.
T
h
e
c
o
m
p
o
s
itio
n
o
f
th
ese
d
atasets
is
s
u
m
m
ar
ized
in
T
a
b
le
1
.
T
ab
le
1
.
Data
s
et
d
etail
s
No
D
a
t
a
s
e
t
To
t
a
l
sam
p
l
e
s
P
a
y
l
o
a
d
si
z
e
D
D
o
S
N
o
r
mal
1
C
I
C
-
2
0
1
9
10
,
000
2
9
1
b
y
t
e
s
8
,
3
1
6
1
,
6
8
4
2
M
I
B
-
2
0
1
6
4
,
9
9
8
1
9
6
b
y
t
e
s
3
,
1
0
5
6
,
8
9
5
3
H
2
N
-
P
a
y
l
o
a
d
1
,
9
5
4
8
9
b
y
t
e
s
1
,
0
9
4
8
6
0
Af
ter
co
llectin
g
d
ata,
p
r
o
ce
e
d
to
th
e
s
ec
o
n
d
s
tag
e
b
y
p
r
o
p
o
s
in
g
a
co
n
s
tr
u
ctio
n
m
o
d
el
f
o
r
DDo
S
d
etec
tio
n
b
y
id
e
n
tify
in
g
th
e
p
ay
lo
ad
u
s
in
g
th
e
o
n
lin
e
ap
p
licatio
n
h
p
d
.
g
asm
i.n
et
an
d
th
e
s
ca
p
y
m
o
d
u
le
r
u
n
th
r
o
u
g
h
J
u
p
y
ter
No
teb
o
o
k
.
R
aw
d
ata
i
s
u
p
lo
ad
ed
,
th
e
n
th
e
g
en
er
al
f
ield
s
ar
e
s
ep
ar
ate
d
in
to
p
ac
k
et
d
ata.
T
h
e
f
ield
s
in
clu
d
e
E
th
er
n
et,
I
Pv
4
,
T
C
P,
an
d
HT
T
P
0
.
A
t
t
h
is
s
t
a
g
e
,
p
a
y
l
o
a
d
i
d
e
n
t
i
f
i
ca
t
i
o
n
f
o
c
u
s
e
s
o
n
t
h
e
H
T
T
P
p
r
o
t
o
c
o
l
[
1
9
]
.
A
f
t
e
r
s
e
p
a
r
at
i
n
g
t
h
e
f
i
e
l
d
s
,
t
h
e
d
a
t
a
p
a
c
k
e
t
p
a
y
l
o
a
d
s
a
r
e
c
o
l
l
ec
t
e
d
.
A
n
a
n
a
l
y
s
is
is
c
a
r
r
ie
d
o
u
t
t
o
t
h
e
n
e
x
t
s
t
a
g
e
,
s
u
c
h
as
f
o
r
m
i
n
g
a
p
a
t
t
e
r
n
b
y
t
a
k
i
n
g
a
h
e
x
a
d
e
c
i
m
a
l
s
t
r
i
n
g
f
r
o
m
t
h
e
n
o
r
m
a
l
p
a
y
l
o
a
d
,
t
h
e
n
t
a
k
i
n
g
t
h
e
s
t
r
i
n
g
p
a
t
t
e
r
n
f
r
o
m
t
h
e
o
b
s
e
r
v
e
d
p
a
y
l
o
a
d
a
n
d
s
t
o
r
i
n
g
t
h
e
p
a
tt
e
r
n
s
t
h
a
t
ap
p
e
a
r
,
c
a
l
c
u
l
at
i
n
g
t
h
e
f
r
e
q
u
e
n
c
y
a
n
d
t
o
t
a
l
f
r
e
q
u
e
n
c
y
o
f
e
a
c
h
.
E
a
c
h
p
a
tt
e
r
n
s
t
a
r
ts
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
2
5
2
-
8
9
3
8
I
n
t J Ar
tif
I
n
tell
,
Vo
l.
1
4
,
No
.
6
,
Dec
em
b
er
2
0
2
5
:
4
7
6
3
-
4
7
7
4
4766
f
r
o
m
1
-
t
o
6
-
G
r
a
m
,
c
a
l
c
u
l
a
te
s
c
h
i
-
s
q
u
a
r
e
d
is
t
a
n
c
e
(
C
S
D
)
b
e
t
w
e
e
n
p
a
c
k
e
t
s
,
a
n
d
p
e
r
f
o
r
m
s
n
o
r
m
a
l
p
a
c
k
e
t
c
l
a
s
s
i
f
ic
a
t
i
o
n
o
r
D
D
o
S
a
tt
a
c
k
s
u
s
i
n
g
m
a
c
h
i
n
e
l
e
a
r
n
i
n
g
.
T
h
e
d
e
t
e
r
m
i
n
a
t
i
o
n
o
f
w
h
e
t
h
e
r
t
h
e
p
ac
k
a
g
e
i
s
d
a
n
g
e
r
o
u
s
o
r
n
o
t
i
s
d
e
t
e
r
m
i
n
e
d
b
a
s
e
d
o
n
t
h
e
P
e
a
r
s
o
n
c
h
i
-
s
q
u
a
r
e
t
e
s
t
a
n
a
l
y
s
is
r
es
u
l
ts
,
a
c
c
o
r
d
i
n
g
t
o
t
h
e
h
y
p
o
t
h
e
s
i
s
f
o
r
m
e
d
[
2
0
]
.
A
f
t
e
r
t
h
i
s
s
t
a
g
e
i
s
d
o
n
e
,
a
ll
p
a
y
l
o
a
d
s
a
n
a
l
y
ze
d
w
i
ll
b
e
l
a
b
e
l
e
d
n
o
r
m
a
l
o
r
D
D
o
S
cl
as
s
es
.
T
h
e
n
i
n
t
h
e
t
h
i
r
d
s
t
a
g
e
,
i
m
p
l
em
e
n
t
i
n
g
h
y
b
r
i
d
N
-
g
r
a
m
[
2
1
]
.
H
e
u
r
i
s
t
i
c
t
e
c
h
n
i
q
u
es
b
y
s
e
l
e
ct
in
g
f
e
a
t
u
r
e
s
o
n
t
h
e
d
a
t
as
e
t
f
o
r
m
e
d
f
r
o
m
1
-
G
r
a
m
t
o
6
-
G
r
a
m
,
f
e
a
t
u
r
e
s
el
ec
t
i
o
n
u
s
i
n
g
w
e
i
g
h
t
c
o
r
r
e
l
at
i
o
n
.
A
f
t
e
r
s
el
e
c
t
i
n
g
t
h
e
f
e
a
t
u
r
e
s
,
t
h
e
p
a
y
l
o
a
d
cl
a
s
s
i
f
ica
t
i
o
n
i
s
d
o
n
e
u
s
i
n
g
t
h
e
S
V
M
,
K
N
N
,
a
n
d
NN
al
g
o
r
i
t
h
m
s
.
I
n
t
h
e
f
i
n
a
l
s
t
a
g
e
,
t
h
e
t
h
r
e
e
d
a
t
a
s
et
s
e
n
h
a
n
c
e
d
wi
t
h
th
e
n
e
w
l
y
e
x
t
r
a
c
t
e
d
f
e
at
u
r
e
s
a
r
e
e
v
a
l
u
a
t
e
d
u
s
i
n
g
s
t
a
n
d
a
r
d
p
er
f
o
r
m
a
n
c
e
m
e
t
r
i
c
s
,
i
n
c
l
u
d
i
n
g
a
c
c
u
r
a
c
y
,
p
r
e
c
i
s
i
o
n
,
r
e
c
a
l
l
,
F
-
m
e
as
u
r
e
,
a
n
d
r
e
c
e
iv
e
r
o
p
e
r
a
t
i
n
g
c
h
a
r
a
c
t
e
r
i
s
t
i
c
-
a
r
e
a
u
n
d
e
r
t
h
e
c
u
r
v
e
(
R
OC
-
A
UC
)
,
t
o
as
s
e
s
s
t
h
e
i
r
e
f
f
e
c
t
i
v
e
n
ess
i
n
d
e
t
e
ct
i
n
g
D
D
o
S
a
t
t
ac
k
s
.
A
c
o
m
p
a
r
at
iv
e
a
n
a
l
y
s
i
s
o
f
t
h
e
p
e
r
f
o
r
m
a
n
c
e
a
c
r
o
s
s
d
i
f
f
e
r
e
n
t
m
a
c
h
i
n
e
s
l
e
a
r
n
i
n
g
a
l
g
o
r
i
t
h
m
s
is
th
e
n
c
o
n
d
u
c
t
e
d
.
T
h
e
o
v
e
r
a
l
l
r
ese
a
r
c
h
m
e
t
h
o
d
o
l
o
g
y
[
2
2
]
i
s
i
l
l
u
s
t
r
at
e
d
i
n
Fi
g
u
r
e
1
.
Fig
u
r
e
1
.
AI
-
b
ased
d
esig
n
an
d
ex
p
er
im
en
tal
m
eth
o
d
s
ap
p
lied
Fig
u
r
e
1
o
u
tlin
es
th
e
p
r
o
p
o
s
ed
DDo
S
attac
k
d
etec
tio
n
a
p
p
r
o
ac
h
,
wh
ich
is
b
ased
o
n
a
h
eu
r
is
tic
f
r
am
ewo
r
k
.
T
h
is
f
r
am
ew
o
r
k
is
g
en
er
ally
d
iv
id
e
d
in
t
o
two
co
m
p
le
m
en
tar
y
co
m
p
o
n
e
n
ts
:
p
atter
n
-
b
ased
a
n
d
an
o
m
aly
-
b
ased
d
etec
tio
n
—
eith
er
o
r
b
o
th
o
f
wh
ic
h
m
ay
b
e
e
m
p
lo
y
ed
d
ep
en
d
in
g
o
n
th
e
co
n
tex
t.
T
h
e
h
e
u
r
is
tic
-
b
ased
m
eth
o
d
o
lo
g
y
en
c
o
m
p
a
s
s
es
f
o
u
r
m
ain
ca
teg
o
r
ies
o
f
DDo
S
d
etec
tio
n
tech
n
iq
u
es:
k
n
o
wled
g
e
-
b
ased
,
s
tatis
t
ical
-
b
ased
,
s
o
f
t
co
m
p
u
tin
g
-
b
ased
,
an
d
m
ac
h
i
n
e
le
ar
n
in
g
-
b
ased
.
E
ac
h
ca
te
g
o
r
y
em
p
lo
y
s
d
is
tin
ct
alg
o
r
ith
m
s
tailo
r
ed
to
its
u
n
d
er
ly
in
g
p
r
in
cip
les.
W
h
en
a
k
n
o
wled
g
e
-
b
ased
ap
p
r
o
ac
h
is
ad
o
p
ted
,
th
e
f
o
cu
s
s
h
if
ts
to
an
aly
zin
g
p
ac
k
et
s
tr
u
ctu
r
es,
p
ar
ticu
lar
ly
h
ea
d
er
s
an
d
p
ay
lo
ad
s
.
I
n
c
o
n
tr
ast,
a
s
tati
s
tical
-
b
ased
ap
p
r
o
ac
h
lev
er
ag
es
m
o
d
els
s
u
ch
as
C
SD,
co
r
r
elatio
n
an
al
y
s
is
,
an
aly
s
is
o
f
v
ar
ian
ce
(
A
NOVA
)
,
an
d
b
o
th
p
ar
am
etr
ic
an
d
n
o
n
-
p
a
r
am
etr
i
c
s
tatis
tica
l te
s
t
s
to
id
en
tify
d
e
v
iatio
n
s
f
r
o
m
n
o
r
m
al
tr
af
f
ic
b
eh
av
io
r
.
T
h
e
s
o
f
t
co
m
p
u
tin
g
-
b
ased
ca
teg
o
r
y
in
teg
r
ates
h
i
g
h
l
y
ef
f
icien
t
al
g
o
r
ith
m
s
a
n
d
ad
v
an
ce
d
co
m
p
u
tatio
n
al
tech
n
i
q
u
es
,
in
clu
d
in
g
f
u
zz
y
lo
g
ic,
a
r
tific
ial
n
eu
r
al
n
etwo
r
k
s
,
a
n
d
p
r
o
b
a
b
ilis
tic
r
ea
s
o
n
in
g
t
o
h
an
d
le
th
e
u
n
ce
r
tain
ty
an
d
co
m
p
lex
ity
in
h
er
en
t
in
n
etwo
r
k
tr
af
f
ic
[
2
3
]
.
Similar
ly
,
m
ac
h
in
e
lear
n
in
g
s
er
v
es
as
an
in
tellig
en
t
s
y
s
tem
ca
p
a
b
le
o
f
im
p
r
o
v
in
g
its
p
er
f
o
r
m
a
n
ce
o
v
er
tim
e
th
r
o
u
g
h
ex
p
er
ien
c
e,
ad
ap
tin
g
to
n
ew
attac
k
p
atter
n
s
b
ased
o
n
f
ee
d
b
ac
k
f
r
o
m
p
r
io
r
task
s
an
d
e
v
alu
atio
n
m
etr
ics
[
2
4
]
.
No
tab
ly
,
h
eu
r
is
tic
m
eth
o
d
s
in
th
is
s
tu
d
y
p
er
f
o
r
m
d
ee
p
in
s
p
ec
tio
n
o
f
th
e
HT
T
P
p
r
o
to
co
l,
s
p
ec
if
ically
ex
am
in
in
g
p
ac
k
et
co
n
ten
ts
ass
o
ciate
d
with
co
m
m
o
n
r
eq
u
est m
eth
o
d
s
s
u
ch
as
POST,
GE
T
,
an
d
o
th
er
p
r
o
to
co
l
-
s
p
ec
if
ic
co
m
m
an
d
s
[
2
5
]
.
T
h
e
p
ay
lo
ad
is
f
ir
s
t
ex
tr
ac
ted
an
d
co
n
v
er
t
ed
in
to
h
ex
ad
ec
im
al
f
o
r
m
at
to
en
ab
le
N
-
g
r
am
an
aly
s
is
.
T
wo
k
ey
s
im
ilar
ity
m
ea
s
u
r
es
ar
e
th
en
ap
p
lied
:
C
SD
an
d
co
s
in
e
s
im
ilar
ity
(
C
S).
C
S
D
q
u
an
tifie
s
th
e
d
iv
er
g
en
ce
b
etwe
en
a
n
o
b
s
er
v
ed
p
a
y
lo
ad
an
d
a
b
aselin
e
(
n
o
r
m
al
)
p
ay
lo
a
d
,
wh
ile
C
S
m
ea
s
u
r
es
th
eir
d
eg
r
ee
o
f
s
im
ilar
ity
wh
er
e
a
C
S
v
alu
e
clo
s
er
to
1
in
d
icate
s
h
ig
h
er
r
esem
b
lan
ce
t
o
n
o
r
m
al
tr
af
f
ic.
T
h
ese
co
m
p
u
tatio
n
s
y
ield
tw
o
n
o
v
el
h
y
b
r
id
f
ea
tu
r
es:
C
SDPay
lo
ad
+
N
-
g
r
am
an
d
C
SP
ay
lo
ad
+
N
-
g
r
am
.
E
ac
h
f
ea
tu
r
e
is
ass
ig
n
ed
a
n
u
m
er
ical
v
alu
e
an
d
a
d
ec
is
io
n
th
r
esh
o
ld
,
wh
ich
to
g
et
h
er
d
eter
m
in
e
wh
eth
er
a
g
iv
en
p
ac
k
et
s
h
o
u
ld
b
e
clas
s
if
ied
as
m
alicio
u
s
.
T
h
e
p
s
eu
d
o
co
d
e
o
r
alg
o
r
ith
m
ic
f
o
r
m
u
l
atio
n
u
s
ed
to
d
er
iv
e
th
is
h
y
b
r
id
N
-
g
r
am
f
ea
tu
r
e
(
c
o
m
b
in
in
g
C
SDPay
lo
ad
an
d
C
SP
ay
lo
ad
)
is
p
r
esen
ted
i
n
Ps
eu
d
o
co
d
e
1
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J Ar
tif
I
n
tell
I
SS
N:
2252
-
8
9
3
8
Hyb
r
id
N
-
g
r
a
m
-
b
a
s
ed
fr
a
mewo
r
k
fo
r
p
a
ylo
a
d
DDo
S
d
etec
t
io
n
…
(
A
n
d
i Ma
s
la
n
)
4767
Ps
eu
d
o
co
d
e
1
.
Pro
ce
s
s
o
f
cr
ea
tin
g
th
e
N
-
g
r
am
p
atter
n
s
Aim
:
Making N
-
gram Patterns
Input
:
Value of n and N
-
gram
Output
:
pattern as N
-
gram that appears
def StringBreaker(string,divider):
i=0
result={}
mylist=[]
str_len=len(string)
while(i<str_len):
newstr=string[i:i+divider]
new_str=newstr.replace(' ','space') # replace ' '
mylist.append(new_str)
i+=1
result['original_string']=string
result['char_separation']=mylist
dict={}
for n in mylist:
keys=dict.keys()
if n in keys: #
dict[n] +=1
else:
dict[n]=1
result['char_grouping']=dict
return result
Ps
eu
d
o
co
d
e
d
escr
ib
es th
e
p
r
o
c
ess
o
f
cr
ea
tin
g
th
e
N
-
g
r
am
p
atter
n
s
th
at
ap
p
ea
r
i
n
th
e
p
a
ck
et
as f
o
llo
ws:
i)
C
r
ea
te
a
f
u
n
ctio
n
to
s
p
lit th
e
s
tr
in
g
.
ii)
Dec
lar
e
th
e
r
esu
lt,
wh
ich
is
a
v
alu
e
r
etu
r
n
o
b
ject.
iii)
Dec
lar
e
ar
r
ay
m
y
lis
t to
h
o
ld
s
tr
in
g
v
alu
es sp
lit p
er
d
iv
id
er
.
iv
)
C
alcu
latin
g
s
tr
in
g
len
g
th
v)
I
f
less
th
an
s
tr
in
g
len
g
t
h
,
th
en
p
u
s
h
d
ata
to
a
r
r
ay
m
y
lis
t.
v
i)
I
n
ea
ch
c
h
ar
ac
ter
,
ta
k
e
an
d
r
ea
d
th
e
ch
ar
ac
te
r
alo
n
g
th
e
d
i
v
id
er
.
v
ii)
Use th
e
wo
r
d
s
p
ac
e
to
m
a
k
e
it
ea
s
ier
.
v
iii)
Ad
d
th
e
wo
r
d
s
p
ac
e
to
m
y
lis
t.
ix
)
Dec
lar
e
a
v
ar
iab
le
d
ict
to
s
to
r
e
ca
lcu
latio
n
r
esu
lts
.
x)
Sp
ec
if
y
alias v
ar
iab
le
f
o
r
ea
ch
v
alu
e
in
m
y
lis
t.
x
i)
I
f
th
e
v
a
r
iab
le
h
as b
ee
n
r
ea
d
i
n
th
e
p
r
e
v
io
u
s
v
al
u
e,
th
en
s
et
q
ty
+1
f
o
r
th
e
v
ar
iab
le
T
o
im
p
lem
en
t
th
is
alg
o
r
ith
m
,
th
e
p
r
o
g
r
am
m
o
d
u
les
u
s
ed
in
p
y
th
o
n
p
r
o
g
r
a
m
m
in
g
ar
e
J
u
p
y
ter
No
teb
o
o
k
an
d
s
cik
it
-
lear
n
.
3.
RE
SU
L
T
S AN
D
D
I
SCU
SS
I
O
N
T
h
is
s
ec
tio
n
p
r
esen
ts
th
e
r
esu
l
ts
o
f
d
ata
p
ac
k
et
co
n
s
tr
u
ctio
n
u
s
in
g
th
e
N
-
g
r
am
m
eth
o
d
.
T
h
e
ex
tr
ac
ted
p
ay
lo
ad
s
a
r
e
ca
teg
o
r
ized
in
to
two
ty
p
es:
DDo
S
p
a
y
lo
ad
s
a
n
d
n
o
r
m
al
(
b
e
n
ig
n
)
p
a
y
lo
ad
s
.
I
n
itially
,
n
etwo
r
k
tr
af
f
ic
d
ata
co
n
tain
in
g
b
o
th
DDo
S
attac
k
p
ac
k
ets
[
2
6
]
an
d
r
eg
u
lar
tr
af
f
ic
p
ac
k
ets
ar
e
co
llected
f
r
o
m
th
r
ee
s
o
u
r
ce
s
:
th
e
C
I
C
2
0
1
9
,
MI
B
2
0
1
6
,
an
d
H2
N
-
Pay
lo
ad
d
atas
ets.
Su
b
s
eq
u
en
tly
,
t
h
e
p
a
y
lo
a
d
p
o
r
tio
n
s
o
f
th
ese
p
ac
k
ets
ar
e
ex
tr
ac
ted
in
h
e
x
ad
ec
im
al
f
o
r
m
at
u
s
in
g
a
c
o
m
b
in
atio
n
o
f
o
n
lin
e
to
o
ls
an
d
cu
s
to
m
s
cr
ip
ts
d
ev
elo
p
e
d
in
Py
th
o
n
.
3
.
1
.
P
re
pa
r
a
t
io
n
da
t
a
s
et
re
s
ult
T
h
e
id
en
tifie
d
p
a
y
lo
ad
s
[
2
6
]
wer
e
ex
tr
ac
ted
f
r
o
m
u
n
p
r
o
ce
s
s
ed
d
ata
f
o
r
f
u
r
th
er
ex
am
i
n
atio
n
.
B
ef
o
r
e
b
ein
g
co
n
v
er
ted
in
to
h
e
x
ad
ec
i
m
al
f
o
r
m
,
t
h
e
r
aw
d
ata
was id
en
tifie
d
as a
p
ac
k
et
ca
p
t
u
r
e
(
P
C
AP
)
f
ile
[
27
]
f
r
o
m
th
e
C
I
C
-
2
0
1
9
d
ataset,
th
e
n
e
x
tr
ac
ted
u
s
in
g
th
e
Scap
y
Py
th
o
n
m
o
d
u
le
as
s
h
o
wn
i
n
Fig
u
r
e
2
.
T
h
e
f
ir
s
t
s
tep
in
an
aly
zin
g
th
e
d
ata
p
a
y
lo
ad
is
to
id
en
tify
r
aw
d
ata
in
th
e
p
ac
k
et.
I
t
ca
n
b
e
s
ee
n
th
at
th
e
b
lu
e
o
n
e
is
a
f
ea
tu
r
e
o
f
th
e
d
ata
p
ac
k
et,
wh
ile
th
e
r
ed
o
n
e
is
th
e
p
r
o
to
co
l
ty
p
e
an
d
also
d
escr
ib
es
th
e
o
p
en
s
y
s
te
m
s
in
ter
co
n
n
ec
tio
n
(
OSI
)
lay
er
.
T
h
en
,
th
e
co
n
v
er
s
io
n
p
r
o
ce
s
s
f
r
o
m
tex
t to
h
ex
a
d
ec
im
al
is
ca
r
r
ied
o
u
t a
s
s
h
o
wn
in
Fig
u
r
e
3
.
3
.
2
.
P
r
o
po
s
ed
N
-
g
ra
m
t
ec
hn
iqu
e
f
o
r
DDo
S a
t
t
a
c
k
s
det
ec
t
io
n
Step
2
em
p
l
o
y
s
th
e
N
-
g
r
am
a
p
p
r
o
ac
h
d
etailed
in
th
e
f
o
llo
w
in
g
s
u
b
-
c
h
ap
ter
to
lo
ca
te
an
d
r
ec
o
n
s
tr
u
ct
th
e
p
ay
lo
ad
.
W
h
en
th
e
p
ay
lo
a
d
f
r
o
m
a
d
ata
p
ac
k
et
in
th
e
C
I
C
-
2
0
1
9
d
ataset
is
ex
tr
ac
ted
u
s
in
g
th
e
Hex
Pack
et
Dec
o
d
er
to
o
l
(
g
asm
i.n
et)
,
th
e
r
esu
ltin
g
o
u
tp
u
t
is
d
is
p
lay
ed
in
Fig
u
r
e
4
.
Fig
u
r
e
4
s
h
o
ws
th
e
o
u
tco
m
e
o
f
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
2
5
2
-
8
9
3
8
I
n
t J Ar
tif
I
n
tell
,
Vo
l.
1
4
,
No
.
6
,
Dec
em
b
er
2
0
2
5
:
4
7
6
3
-
4
7
7
4
4768
id
en
tify
in
g
th
e
p
ay
lo
a
d
o
f
d
ata
p
ac
k
ets,
in
clu
d
in
g
r
eg
u
lar
a
n
d
an
aly
za
b
le
d
ata
p
ac
k
ets
d
i
v
id
ed
in
to
m
u
ltip
le
f
ield
s
.
T
h
e
f
o
llo
win
g
f
ield
d
escr
ip
tio
n
s
ap
p
ly
to
ea
ch
a
n
d
e
v
er
y
d
ata
p
ac
k
et.
Fig
u
r
e
2
.
Sam
p
le
r
aw
d
ata
C
I
C
-
2
0
1
9
d
ataset
Fig
u
r
e
3
.
Pay
lo
a
d
r
aw
Fig
u
r
e
4
.
Pay
lo
a
d
h
e
x
Pay
lo
ad
s
ep
ar
atio
n
,
as
s
h
o
w
n
in
T
a
b
le
2
,
was
p
er
f
o
r
m
e
d
u
s
in
g
th
e
Scap
y
m
o
d
u
le
im
p
le
m
en
ted
in
Py
th
o
n
.
T
h
is
p
r
o
ce
s
s
d
em
o
n
s
tr
ates
th
at
th
e
d
ata
p
ac
k
et
f
ield
s
,
an
d
th
e
HT
T
P
p
r
o
to
c
o
l
p
ay
lo
a
d
ca
n
b
e
ef
f
ec
tiv
ely
is
o
lated
.
T
a
b
le
3
p
r
esen
ts
th
e
r
esu
lts
o
f
ex
tr
ac
tin
g
r
aw
n
etwo
r
k
d
ata
an
d
co
n
v
e
r
tin
g
it
i
n
to
h
ex
ad
ec
im
al
f
o
r
m
at,
y
ield
in
g
t
h
e
h
ex
p
ay
lo
a
d
u
s
ed
f
o
r
s
u
b
s
e
q
u
en
t a
n
al
y
s
is
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J Ar
tif
I
n
tell
I
SS
N:
2252
-
8
9
3
8
Hyb
r
id
N
-
g
r
a
m
-
b
a
s
ed
fr
a
mewo
r
k
fo
r
p
a
ylo
a
d
DDo
S
d
etec
t
io
n
…
(
A
n
d
i Ma
s
la
n
)
4769
T
ab
le
2
.
Field
p
ac
k
et
d
escr
ip
ti
o
n
F
i
e
l
d
H
e
x
a
d
e
c
i
m
a
l
Et
h
e
r
n
e
t
0
0
c
1
b
1
1
4
e
b
3
1
b
8
a
c
6
f
3
6
0
a
8
b
0
8
0
0
I
P
V
4
4
5
0
0
0
1
6
c
3
5
2
a
4
0
0
0
8
0
0
6
e
8
0
d
c
0
a
8
0
a
0
f
0
d
6
b
0
4
3
2
TC
P
c
1
2
b
0
0
5
0
a
4
f
8
9
6
d
8
2
8
2
3
7
a
c
e
5
0
1
8
0
1
0
2
4
9
6
2
0
0
0
0
H
TTP
A
l
l
0
0
c
1
b
1
1
4
e
b
3
1
b
8
a
c
6
f
3
6
0
a
8
b
0
8
0
0
4
5
0
0
0
0
f
e
1
5
7
8
4
0
0
0
8
0
0
6
f
e
b
3
c
0
a
8
0
a
0
5
1
7
0
f
0
4
1
2
c
0
2
6
0
0
5
0
b
7
b
2
2
6
b
2
6
a
7
0
d
d
f
5
5
0
1
8
0
1
0
0
a
2
a
2
0
0
0
0
4
8
4
5
4
1
4
4
2
0
2
f
6
5
6
d
6
4
6
c
2
f
6
3
2
f
3
2
3
0
3
1
3
7
2
f
3
0
3
3
2
f
6
1
6
2
6
d
5
f
6
6
6
5
6
1
3
8
3
4
3
3
6
3
6
5
3
0
3
2
6
6
3
5
6
2
3
7
3
3
6
2
6
3
3
2
6
5
3
2
3
1
3
1
3
4
3
8
3
9
6
2
3
9
6
6
6
1
3
4
3
0
3
1
6
2
6
2
3
1
6
3
6
2
6
4
6
4
3
5
2
e
6
3
6
1
6
2
2
0
4
8
5
4
5
4
5
0
2
f
3
1
2
e
3
1
0
d
0
a
4
3
6
f
6
e
6
e
6
5
6
3
7
4
6
9
6
f
6
e
3
a
2
0
4
b
6
5
6
5
7
0
2
d
4
1
6
c
6
9
7
6
6
5
0
d
0
a
4
1
6
3
6
3
6
5
7
0
7
4
3
a
2
0
2
a
2
f
2
a
0
d
0
a
4
1
6
3
6
3
6
5
7
0
7
4
2
d
4
5
6
e
6
3
6
f
6
4
6
9
6
e
6
7
3
a
2
0
6
9
6
4
6
5
6
e
7
4
6
9
7
4
7
9
0
d
0
a
5
5
7
3
6
5
7
2
2
d
4
1
6
7
6
5
6
e
7
4
3
a
2
0
4
d
6
9
6
3
7
2
6
f
7
3
6
f
6
6
7
4
2
0
4
2
4
9
5
4
5
3
2
f
3
7
2
e
3
7
0
d
0
a
4
8
6
f
7
3
7
4
3
a
2
0
6
2
6
7
3
4
2
e
7
6
3
4
2
e
6
5
6
d
6
4
6
c
2
e
7
7
7
3
2
e
6
d
6
9
6
3
7
2
6
f
7
3
6
f
6
6
7
4
2
e
6
3
6
f
6
d
0
d
0
a
0
d
0
a
T
ab
le
3
.
Sam
p
le
p
ac
k
et
d
ata
f
r
o
m
C
I
C
-
2019
d
atasets
No
sr
c
d
st
sp
o
r
t
d
p
o
r
t
P
a
y
l
o
a
d
h
e
x
1
1
1
.
5
1
.
1
0
0
.
4
5
1
0
.
1
.
9
.
1
7
6
8
0
3
5
9
4
b
'0
0
0
0
0
0
0
0
0
0
0
0
'
2
2
3
.
3
6
.
3
3
.
9
3
1
9
2
.
1
6
8
.
1
0
.
1
4
80
4
9
4
6
3
b
'4
8
5
4
5
4
5
0
2
f
3
1
2
e
3
1
2
0
3
2
3
0
3
0
2
0
4
f
4
b
0
d
0
a
4
3
6
f
6
e
7
4
6
5
.
.
.
3
2
3
.
3
6
.
3
3
.
9
3
1
9
2
.
1
6
8
.
1
0
.
1
4
80
4
9
4
6
3
b
'4
e
6
1
6
d
6
5
3
d
2
2
4
f
7
4
7
4
6
1
7
7
6
1
2
2
2
0
6
8
6
9
6
e
7
4
2
d
6
f
7
6
6
5
.
.
.
1
8
4
1
9
2
.
1
6
8
.
1
0
.
5
2
3
.
1
5
.
4
.
1
8
4
9
1
9
0
80
b
'0
a
4
8
6
f
7
3
7
4
3
a
2
0
6
2
6
7
3
4
2
e
7
6
3
4
2
e
6
5
6
d
6
4
6
c
2
e
7
7
7
3
2
e
6
d
6
9
6
3
7
2
6
f
7
3
6
f
6
6
7
4
2
e
6
3
6
f
6
d
0
d
0
a
0
d
0
a
.
.
.
1
8
5
2
3
.
1
9
4
.
1
8
2
.
6
3
1
9
2
.
1
6
8
.
1
0
.
1
4
80
4
9
4
6
2
b
'4
8
6
f
7
3
7
4
3
a
2
0
6
1
7
5
2
e
6
4
6
f
7
7
6
e
6
c
6
f
6
1
6
4
2
e
7
7
6
9
6
e
6
4
6
f
7
7
7
3
7
5
7
0
6
4
6
1
7
4
6
5
2
e
6
3
6
f
6
d
0
d
0
a
0
d
0
a
.
.
.
3
.
3
.
Resul
t
N
-
g
ra
m
pa
t
t
er
n f
o
rm
a
t
io
n
Af
ter
id
en
tify
in
g
a
n
d
an
al
y
zin
g
p
ay
lo
a
d
s
tr
in
g
s
f
o
r
DDo
S
attac
k
p
atter
n
s
,
th
e
f
r
eq
u
e
n
cy
o
f
ea
c
h
N
-
g
r
am
s
eq
u
e
n
ce
is
ca
lcu
late
d
to
ca
teg
o
r
ize
th
e
p
ay
lo
a
d
s
in
to
2
-
,
3
-
,
4
-
,
5
-
,
an
d
6
-
Gr
a
m
g
r
o
u
p
s
.
On
ce
all
th
r
ee
d
atasets
h
av
e
b
ee
n
p
r
o
ce
s
s
ed
an
d
co
n
v
er
te
d
,
th
e
N
-
g
r
am
ap
p
r
o
ac
h
s
p
a
n
n
in
g
f
r
o
m
2
-
to
6
-
G
r
am
is
ap
p
lied
to
id
en
tif
y
r
ec
u
r
r
in
g
p
ay
lo
ad
p
atter
n
s
.
An
illu
s
tr
ativ
e
ex
am
p
le
o
f
t
h
is
p
ay
lo
ad
a
n
a
ly
s
is
is
p
r
o
v
id
ed
in
T
ab
le
4.
B
ased
o
n
th
e
N
-
g
r
a
m
p
atter
n
f
o
r
m
atio
n
m
o
d
el
i
n
Fig
u
r
e
4
,
T
a
b
le
4
s
h
o
ws
th
e
s
h
if
t
o
f
o
b
s
er
v
e
d
ch
ar
g
e
an
d
n
o
r
m
al
ch
a
r
g
e
f
r
o
m
2
-
to
6
-
Gr
am
.
E
x
am
p
les
o
f
o
b
s
er
v
ed
ch
a
r
g
e
an
d
n
o
r
m
al
c
h
ar
g
e
f
o
r
2
-
,
3
-
,
4
-
,
5
-
an
d
6
-
Ng
r
am
ar
e
e
x
p
lain
ed
in
T
ab
le
4
wh
ic
h
s
h
o
ws th
e
f
o
r
m
atio
n
o
f
N
-
g
r
a
m
p
atter
n
.
T
ab
le
4
.
Sli
d
in
g
s
tr
in
g
p
ay
l
o
a
d
N
-
g
r
a
m
S
l
i
d
i
n
g
st
r
i
n
g
p
a
y
l
o
a
d
o
b
ser
v
e
d
S
l
i
d
i
n
g
st
r
i
n
g
p
a
y
l
o
a
d
n
o
r
ma
l
2
‘
0
0
’
,
‘
0
c
’
,
‘
c
1
’
,
‘
1
b
’
,
‘
b
1
’
,
‘
1
1
’
…
‘
0
0
’
,
‘
0
c
’
,
‘
c
1
’
,
‘
1
b
’
,
‘
b
1
’
…
3
‘
0
0
c
’
,
‘
0
c
1
’
,
‘
c
1
b
’
,
‘
1
b
1
’
…
‘
0
0
c
’
,
‘
0
c
1
’
,
‘
c
1
b
’
,
‘
1
b
1
’
,
‘
b
1
1
’
…
4
‘
0
0
c
1
’
,
‘
0
c
1
b
’
,
‘
c
1
b
1
’
,
‘
1
b
1
1
’
…
‘
0
0
c
1
’
,
‘
0
c
1
b
’
,
‘
c
1
b
1
’
,
‘
1
b
1
1
’
…
5
‘
0
0
c
1
b
’
,
‘
0
c
1
b
1
’
,
‘
c
1
b
1
1
’
,
‘
1
b
1
1
4
’
…
‘
0
0
c
1
b
’
,
‘
0
c
1
b
1
’
,
‘
c
1
b
1
1
’
,
‘
1
b
1
1
4
’
…
6
‘
0
0
c
1
b
1
’
,
‘
0
c
1
b
1
1
’
,
‘
c
1
b
1
1
4
’
,
‘
1
b
1
1
4
e
’
…
‘
0
0
c
1
b
1
’
,
‘
0
c
1
b
1
1
’
,
‘
c
1
b
1
1
4
’
…
3
.
4
.
Resul
t
ca
lcula
t
io
n o
f
chi
-
s
qu
a
re
dis
t
a
nce
T
h
is
tech
n
iq
u
e
q
u
a
n
tifie
s
th
e
d
iv
er
g
en
ce
b
etwe
en
n
o
r
m
al
(
b
en
ig
n
)
p
ac
k
ets
an
d
p
ac
k
ets
an
aly
ze
d
u
s
in
g
th
e
C
SD
m
eth
o
d
.
Af
ter
ex
tr
a
ctin
g
th
e
h
e
x
ad
ec
im
al
p
a
y
lo
a
d
an
d
g
en
er
atin
g
a
s
h
if
ted
p
a
y
lo
ad
s
eq
u
e
n
ce
,
th
e
s
o
f
twar
e
ca
lcu
lates
th
e
f
r
eq
u
en
cy
,
r
elativ
e
p
er
ce
n
tag
e,
an
d
C
SD
f
o
r
ea
ch
N
-
g
r
a
m
p
atter
n
,
s
p
ec
if
ically
f
o
r
2
-
to
6
-
Gr
am
.
Ma
n
u
al
C
SD c
alcu
latio
n
u
s
in
g
th
is
alg
o
r
ith
m
i
s
p
er
f
o
r
m
e
d
th
r
o
u
g
h
(
1
)
.
2
=
(
0
.
00
33
22
2
59
13
62
1
26
2
−
0
.
00
18
69
15
88
7
85
0
46
7
)
2
0
.
00
33
2
22
5
91
36
21
2
62
+
(
0
.
01
66
1
12
9
56
81
06
3
1
−
0
.
00
74
76
63
55
14
0
18
6
9
)
2
0
.
01
66
11
29
5
68
10
63
1
+
⋯
…
+
(
0
.
0
2
9
9
0
0
3
3
2
2
2
5
9
1
3
6
−
0
.
0
1
6
8
2
2
4
2
9
9
0
6
5
4
2
)
2
0
.
0
2
9
9
0
0
3
3
2
2
2
5
9
1
3
6
=
0
.
327
(
1
)
T
h
e
Pear
s
o
n
ch
i
-
s
q
u
ar
e
test
was
ap
p
lied
to
d
eter
m
i
n
e
an
ap
p
r
o
p
r
iate
th
r
esh
o
l
d
f
o
r
class
if
y
in
g
th
e
o
b
s
er
v
e
d
p
ay
lo
ad
,
b
ased
o
n
th
e
h
y
p
o
t
h
e
s
es a
s
in
(
2
)
an
d
(
3
)
.
ℎ
ℎ
(
₀
)
:
2
≤
2
(
,
−
1
)
(
2
)
ℎ
ℎ
(
₁
)
:
2
>
2
(
,
−
1
)
(
3
)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
2
5
2
-
8
9
3
8
I
n
t J Ar
tif
I
n
tell
,
Vo
l.
1
4
,
No
.
6
,
Dec
em
b
er
2
0
2
5
:
4
7
6
3
-
4
7
7
4
4770
Her
e,
D2
r
ep
r
esen
ts
th
e
C
SD
b
etwe
en
th
e
an
aly
ze
d
p
a
y
lo
ad
an
d
a
r
ef
e
r
en
ce
p
a
y
lo
a
d
(
eith
er
n
o
r
m
al
o
r
DDo
S),
b
d
en
o
tes
th
e
n
u
m
b
er
o
f
d
is
tin
ct
N
-
g
r
am
p
atter
n
s
in
th
e
r
ef
er
en
ce
p
ay
lo
ad
,
a
n
d
th
e
d
e
g
r
ee
s
o
f
f
r
ee
d
o
m
ar
e
b
−
1
.
T
h
e
s
ig
n
if
ic
an
ce
lev
el
is
s
et
at
α
=0
.
0
5
.
I
n
th
is
co
n
te
x
t,
H
0
in
d
icate
s
th
at
th
e
p
a
y
lo
ad
is
co
n
s
is
ten
t
with
a
DDo
S
attac
k
(
i.e
.
,
it
d
o
es
n
o
t
s
ig
n
if
ican
tly
d
if
f
er
f
r
o
m
th
e
DDo
S
r
ef
er
en
ce
)
,
wh
er
ea
s
H
1
s
u
g
g
ests
th
e
p
ay
lo
ad
is
n
ei
th
er
ty
p
ical
b
en
ig
n
tr
af
f
ic
n
o
r
a
k
n
o
wn
DDo
S
p
atter
n
(
i.e
.
,
it
ex
h
ib
its
s
tatis
tica
l
ly
s
ig
n
if
ican
t
d
ev
iatio
n
)
.
T
h
e
an
aly
s
is
co
m
p
ar
e
d
th
e
co
m
p
u
ted
C
SD
(
D2
=0
.
3
2
7
)
ag
ain
s
t
th
e
cr
itical
v
alu
e
f
r
o
m
th
e
ch
i
-
s
q
u
ar
e
d
is
tr
ib
u
tio
n
tab
le:
χ2
(
0
.
0
5
,
1
4
6
)
=1
7
6
.
2
9
3
.
Sin
c
e
0
.
3
2
7
<
1
7
6
.
2
9
3
,
th
e
n
u
ll
h
y
p
o
th
esis
(
H
0
)
is
n
o
t
r
ejec
t
ed
,
lead
in
g
to
th
e
co
n
clu
s
io
n
th
at
th
e
p
ay
lo
a
d
is
class
if
ied
as a
DDo
S
attac
k
.
T
h
e
r
esu
lts
o
f
th
e
C
SD
ca
lcu
latio
n
f
o
r
2
-
g
r
am
s
ar
e
s
h
o
wn
i
n
T
ab
le
5
,
w
h
ich
in
d
icate
s
th
a
t
th
er
e
is
a
v
ar
iatio
n
in
th
e
p
atter
n
s
o
b
s
er
v
ed
with
in
th
e
p
ac
k
ets.
T
h
er
e
f
o
r
e,
th
e
p
atter
n
s
f
o
u
n
d
in
th
e
o
b
s
er
v
ed
p
ay
l
o
ad
s
h
o
u
ld
b
e
u
s
ed
to
ca
lcu
late
th
e
C
SD
v
alu
e.
C
o
n
s
eq
u
en
tly
,
t
h
e
f
r
eq
u
en
cy
o
f
a
p
atter
n
in
th
e
an
aly
ze
d
p
ac
k
et
is
co
n
s
id
er
ed
ze
r
o
if
it a
p
p
ea
r
s
i
n
th
e
o
b
s
er
v
ed
p
ay
lo
ad
b
u
t
n
o
t in
th
e
s
tu
d
ied
p
ac
k
et.
T
ab
le
5
. 2
-
Gr
am
p
a
y
l
o
ad
p
atter
n
No
O
b
serv
e
d
p
a
y
l
o
a
d
F
N
o
r
mal
p
a
y
l
o
a
d
F
1
49
1
71
1
2
0c
1
7d
1
3
c1
1
c1
1
4
40
1
da
1
5
b1
1
b1
1
6
11
1
11
1
7
3c
1
14
1
13
8a
1
8a
1
14
ac
1
c7
1
15
86
1
49
1
16
4d
1
34
1
17
a5
1
f1
1
18
0a
1
1d
1
20
90
1
18
1
21
51
1
53
1
22
8b
1
35
1
23
b0
1
09
1
1
4
7
63
16
0
3.
5
.
E
x
perim
ent
a
t
io
n
s
um
ma
ry
T
h
e
e
x
p
e
r
i
m
e
n
ts
w
e
r
e
c
o
n
d
u
c
te
d
o
n
f
o
u
r
d
a
t
as
e
ts
t
o
e
v
a
l
u
at
e
t
h
e
e
f
f
ec
t
i
v
e
n
es
s
o
f
f
e
at
u
r
e
s
el
e
c
t
i
o
n
i
n
i
m
p
r
o
v
i
n
g
t
h
e
a
c
c
u
r
a
c
y
o
f
D
Do
S
a
t
t
a
c
k
d
et
e
c
t
i
o
n
u
s
i
n
g
t
h
e
p
r
o
p
o
s
e
d
hybr
i
d
N
-
g
r
a
m
h
e
u
r
i
s
ti
c
t
e
c
h
n
i
q
u
e
.
T
h
r
e
e
m
a
c
h
i
n
e
l
e
a
r
n
i
n
g
a
l
g
o
r
i
t
h
m
s
S
V
M
,
KN
N
,
a
n
d
NN
s
et
s
:
C
S
D
Pa
y
l
o
a
d
+
N
-
g
r
a
m
,
C
SP
a
y
l
o
a
d
+
N
-
g
r
a
m
,
a
n
d
t
h
e
c
o
m
b
i
n
e
d
hybr
i
d
N
-
g
r
a
m
(
C
SD
P
a
y
l
o
a
d
+C
SP
a
y
l
o
a
d
+
N
-
g
r
a
m
)
.
T
h
e
d
e
t
a
i
l
e
d
e
v
a
l
u
a
t
i
o
n
r
es
u
l
ts
a
r
e
s
u
m
m
a
r
i
z
ed
i
n
T
a
b
l
e
s
6
t
h
r
o
u
g
h
8
.
T
h
e
4
-
G
r
a
m
c
o
n
f
i
g
u
r
a
ti
o
n
e
m
e
r
g
e
d
a
s
t
h
e
o
p
ti
m
a
l
N
-
g
r
a
m
s
i
z
e
f
o
r
p
a
y
l
o
a
d
cl
a
s
s
i
f
i
c
a
ti
o
n
.
W
h
e
n
t
h
e
h
y
b
r
i
d
f
e
a
t
u
r
e
C
S
D
Pa
y
l
o
a
d
+N
-
g
r
a
m
+
C
S
P
a
y
l
o
a
d
+N
-
g
r
a
m
w
a
s
a
p
p
li
e
d
t
o
t
h
e
C
I
C
-
2
0
1
9
,
M
I
B
-
2
0
1
6
,
a
n
d
H2
N
-
P
ay
lo
ad
d
a
t
a
s
e
t
s
,
i
t
a
c
h
ie
v
e
d
d
e
t
e
c
t
i
o
n
a
c
c
u
r
a
c
i
es
o
f
9
9
.
8
0
,
9
9
.
7
4
,
a
n
d
9
9
.
6
4
%
,
r
e
s
p
e
c
t
i
v
e
l
y
.
Us
i
n
g
t
h
e
S
V
M
al
g
o
r
i
t
h
m
,
t
h
e
a
v
e
r
a
g
e
ac
c
u
r
a
c
y
a
c
r
o
s
s
t
h
e
t
h
r
e
e
d
at
a
s
et
s
r
e
a
c
h
e
d
9
9
.
7
3
%
,
a
s
u
b
s
t
a
n
t
ia
l
i
m
p
r
o
v
e
m
e
n
t
o
v
e
r
t
h
e
b
a
s
e
l
i
n
e
m
o
d
e
l
w
it
h
o
u
t
N
-
g
r
a
m
f
e
a
t
u
r
e
s
,
w
h
i
c
h
y
i
e
l
d
e
d
o
n
l
y
8
3
.
9
0
%
a
c
c
u
r
a
c
y
.
T
h
i
s
r
e
p
r
e
s
e
n
ts
a
n
a
b
s
o
l
u
te
a
c
c
u
r
a
c
y
g
a
i
n
o
f
1
5
.
8
3
%
p
o
i
n
t
s
(
n
o
t
1
2
.
7
3
%
,
a
s
9
9
.
7
3
%
-
8
3
.
9
0
%
=
1
5
.
8
3
%
)
,
d
e
m
o
n
s
t
r
a
t
in
g
t
h
e
s
i
g
n
i
f
i
c
a
n
t
e
n
h
a
n
c
e
m
e
n
t
i
n
DD
o
S
d
e
t
ec
t
i
o
n
p
e
r
f
o
r
m
a
n
c
e
e
n
a
b
l
e
d
b
y
t
h
e
p
r
o
p
o
s
e
d
N
-
g
r
a
m
t
e
c
h
n
i
q
u
e
.
Ot
h
e
r
f
e
a
t
u
r
e
v
a
r
i
a
n
ts
a
l
s
o
s
h
o
w
e
d
n
o
t
a
b
l
e
i
m
p
r
o
v
e
m
e
n
t
s
i
n
cl
a
s
s
i
f
ic
a
t
i
o
n
a
cc
u
r
a
c
y
.
T
h
e
4
-
G
r
am
c
o
n
f
ig
u
r
atio
n
p
r
o
v
ed
t
o
b
e
th
e
m
o
s
t
ef
f
ec
tiv
e
N
-
g
r
am
s
ize
f
o
r
p
a
y
lo
ad
cla
s
s
if
icatio
n
.
W
h
en
th
e
h
y
b
r
id
f
e
atu
r
e
C
SDPay
lo
ad
+
N
-
g
r
am
+CS
Pay
lo
ad
+4
-
Gr
am
was
ap
p
lied
to
th
e
C
I
C
-
2
0
1
9
,
MI
B
-
2
0
1
6
,
an
d
H2
N
-
P
ay
lo
a
d
d
atasets
u
s
in
g
th
e
KNN
al
g
o
r
ith
m
,
it
ac
h
iev
ed
class
if
icatio
n
ac
cu
r
ac
ies
o
f
9
9
.
7
1
,
9
1
.
6
6
,
an
d
9
4
.
0
6
%,
r
esp
ec
tiv
ely
.
T
h
is
y
ield
s
an
a
v
er
ag
e
ac
cu
r
ac
y
o
f
9
5
.
1
4
%.
I
n
c
o
m
p
ar
is
o
n
,
th
e
s
am
e
m
o
d
el
with
o
u
t
th
e
N
-
g
r
am
f
ea
tu
r
e
ac
h
ie
v
ed
o
n
ly
8
2
.
4
1
%
ac
cu
r
ac
y
.
T
h
e
i
n
co
r
p
o
r
ati
o
n
o
f
th
e
N
-
g
r
am
tech
n
iq
u
e
th
u
s
im
p
r
o
v
e
d
d
ete
ctio
n
ac
cu
r
ac
y
b
y
1
2
.
7
3
%
p
o
in
ts
,
h
ig
h
lig
h
tin
g
its
ef
f
ec
tiv
e
n
ess
in
en
h
an
cin
g
DDo
S a
ttack
d
etec
tio
n
p
er
f
o
r
m
an
ce
.
T
h
e
3
-
an
d
4
-
Gr
am
co
n
f
ig
u
r
atio
n
s
em
er
g
ed
as
th
e
m
o
s
t
ef
f
ec
tiv
e
N
-
g
r
am
s
izes
f
o
r
p
ay
lo
ad
class
if
icatio
n
.
W
h
en
th
e
h
y
b
r
id
f
ea
tu
r
es
C
SDPay
lo
ad
+
N
-
g
r
am
+CS
Pay
lo
ad
+3
-
Gr
am
an
d
C
SDPay
lo
ad
+
N
-
g
r
am
+CS
Pay
lo
ad
+4
-
Gr
am
we
r
e
ap
p
lied
u
s
in
g
a
NN
class
if
ier
,
th
ey
ac
h
iev
ed
h
ig
h
d
etec
tio
n
ac
cu
r
ac
ies ac
r
o
s
s
th
e
th
r
ee
d
atasets
:
9
9
.
9
9
%
o
n
C
I
C
-
2
0
1
9
,
9
9
.
6
4
%
o
n
MI
B
-
2
0
1
6
,
a
n
d
9
9
.
3
3
%
o
n
H2
N
-
P
ay
lo
ad
.
T
h
is
r
esu
lts
in
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J Ar
tif
I
n
tell
I
SS
N:
2252
-
8
9
3
8
Hyb
r
id
N
-
g
r
a
m
-
b
a
s
ed
fr
a
mewo
r
k
fo
r
p
a
ylo
a
d
DDo
S
d
etec
t
io
n
…
(
A
n
d
i Ma
s
la
n
)
4771
an
av
e
r
ag
e
ac
c
u
r
ac
y
o
f
9
9
.
6
5
%.
I
n
co
n
t
r
ast,
th
e
s
am
e
m
o
d
el
with
o
u
t
th
e
N
-
g
r
a
m
f
ea
tu
r
es
ac
h
iev
ed
an
av
er
ag
e
ac
cu
r
ac
y
o
f
o
n
ly
8
5
.
7
4
%.
T
h
e
in
te
g
r
atio
n
o
f
th
e
N
-
g
r
am
tech
n
iq
u
e
th
er
ef
o
r
e
im
p
r
o
v
ed
DDo
S
d
etec
tio
n
ac
cu
r
ac
y
b
y
1
3
.
9
1
%
p
o
in
ts
(
9
9
.
6
5
%
-
8
5
.
7
4
%=1
3
.
9
1
%
)
,
u
n
d
er
s
co
r
in
g
its
s
ig
n
if
ican
t
co
n
tr
ib
u
tio
n
t
o
d
etec
tio
n
p
er
f
o
r
m
a
n
ce
.
T
ab
le
6
.
Acc
u
r
ac
y
d
etail
f
o
r
f
o
u
r
d
atasets
u
s
in
g
th
e
SVM
al
g
o
r
ith
m
D
a
t
a
s
e
t
F
e
a
t
u
r
e
s
A
c
c
u
r
a
c
y
w
i
t
h
o
u
t
N
-
g
r
a
m
N
-
g
r
a
m
f
e
a
t
u
r
e
a
c
c
u
r
a
c
y
1
-
G
2
-
G
3
-
G
4
-
G
5
-
G
6
-
G
C
I
C
2
0
1
9
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
9
7
.
8
6
9
9
.
7
8
9
9
.
8
0
9
9
.
8
0
9
9
.
8
0
9
9
.
0
3
9
9
.
0
2
M
I
B
2
0
1
6
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
9
4
.
8
8
9
8
.
7
2
9
7
.
4
6
9
9
.
6
4
9
9
.
7
4
9
3
.
9
4
9
5
.
1
2
H
2
N
-
P
a
y
l
o
a
d
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
5
8
.
9
6
9
8
.
5
2
9
8
.
3
6
9
8
.
4
1
9
9
.
6
4
9
7
.
7
5
9
8
.
4
1
A
v
e
r
a
g
e
8
3
.
9
0
9
9
.
0
1
9
8
.
5
4
9
9
.
2
8
9
9
.
7
3
9
6
.
9
1
8
3
.
9
0
T
ab
le
7
. A
cc
u
r
ac
y
d
etail
f
o
r
f
o
u
r
d
atasets
u
s
in
g
th
e
KNN
al
g
o
r
ith
m
D
a
t
a
s
e
t
F
e
a
t
u
r
e
s
A
c
c
u
r
a
c
y
w
i
t
h
o
u
t
N
-
g
r
a
m
N
-
g
r
a
m
f
e
a
t
u
r
e
a
c
c
u
r
a
c
y
1
-
G
2
-
G
3
-
G
4
-
G
5
-
G
6
-
G
C
I
C
2
0
1
9
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
9
9
.
5
7
9
9
.
7
0
9
9
.
7
0
9
9
.
7
0
9
9
.
7
1
9
9
.
7
0
9
9
.
7
0
M
I
B
2
0
1
6
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
9
1
.
4
2
7
0
.
4
5
7
0
.
3
7
7
0
.
2
5
9
1
.
6
6
6
9
.
7
9
7
8
.
4
3
H
2
N
-
P
a
y
l
o
a
d
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
5
6
.
2
4
9
1
.
9
7
8
9
.
0
0
7
3
.
1
5
9
4
.
0
6
8
2
.
9
1
9
0
.
6
9
A
v
e
r
a
g
e
8
2
.
4
1
8
7
.
3
7
8
6
.
3
6
8
1
.
0
3
9
5
.
1
4
8
4
.
1
3
8
9
.
6
1
T
ab
le
8
. A
cc
u
r
ac
y
d
etail
f
o
r
f
o
u
r
d
atasets
u
s
in
g
th
e
n
eu
r
al
n
etwo
r
k
alg
o
r
ith
m
D
a
t
a
s
e
t
F
e
a
t
u
r
e
s
A
c
c
u
r
a
c
y
w
i
t
h
o
u
t
N
-
g
r
a
m
N
-
g
r
a
m fe
a
t
u
r
e
a
c
c
u
r
a
c
y
1
-
G
2
-
G
3
-
G
4
-
G
5
-
G
6
-
G
C
I
C
2
0
1
9
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
9
9
.
7
0
9
9
.
9
8
9
9
.
9
9
9
9
.
9
9
9
9
.
9
9
9
9
.
9
8
9
9
.
9
8
M
I
B
2
0
1
6
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
1
0
0
.
0
0
9
9
.
1
2
9
9
.
3
6
9
9
.
6
6
9
9
.
6
4
9
3
.
8
8
9
6
.
2
3
H
2
N
-
P
a
y
l
o
a
d
C
S
D
P
a
y
l
o
a
d
+
C
S
P
a
y
l
o
a
d
+
N
-
g
r
a
m
5
7
.
5
2
9
8
.
6
7
9
9
.
1
8
9
9
.
1
8
9
9
.
3
3
9
8
.
0
0
9
6
.
6
7
A
v
e
r
a
g
e
8
5
.
7
4
9
9
.
2
6
9
9
.
5
1
9
9
.
6
1
9
9
.
6
5
9
7
.
2
9
9
7
.
6
3
3.
6.
Co
m
pa
re
a
lg
o
rit
hm
a
n
d r
esu
lt
Per
f
o
r
m
an
ce
e
v
alu
atio
n
f
o
r
al
l
f
ea
tu
r
es
in
ea
ch
d
ataset
was
also
ca
r
r
ied
o
u
t
i
n
th
is
s
tu
d
y
,
with
th
e
r
esu
lts
s
h
o
wn
in
T
ab
le
9
.
I
n
ad
d
itio
n
,
th
is
s
tu
d
y
also
test
ed
th
e
class
if
icatio
n
p
er
f
o
r
m
a
n
ce
lev
el
f
o
r
DDo
S
attac
k
d
etec
tio
n
u
s
in
g
co
m
b
in
ed
f
ea
tu
r
es.
T
h
e
ac
c
u
r
ac
y
r
at
e
f
o
r
th
e
NN
alg
o
r
ith
m
o
n
C
I
C
-
2
0
1
9
d
ataset
ar
e
9
9
.
9
9
%
r
esp
ec
tiv
ely
.
T
h
e
SVM
alg
o
r
ith
m
ac
h
iev
ed
9
9
.
8
4
an
d
9
9
.
5
4
%
f
o
r
MI
B
-
2
0
1
6
an
d
H2
N
-
P
ay
lo
ad
d
ataset
r
esp
ec
tab
ly
.
T
h
e
KNN
alg
o
r
ith
m
ac
h
iev
ed
9
9
.
5
8
% o
n
H2
N
-
Pay
lo
ad
d
ataset.
T
ab
le
9
. P
er
f
o
r
m
an
ce
ev
alu
ati
o
n
f
o
r
co
m
b
in
in
g
all
f
ea
tu
r
es (
h
y
b
r
id
f
ea
tu
r
es)
u
s
in
g
weig
h
t
b
y
co
r
r
elatio
n
D
a
t
a
s
e
t
N
u
mb
e
r
o
f
f
e
a
t
u
r
e
s
M
a
c
h
i
n
e
l
e
a
r
n
i
n
g
a
l
g
o
r
i
t
h
ms
A
c
c
u
r
a
c
y
R
e
c
a
l
l
P
r
e
c
i
s
i
o
n
C
I
C
-
2
0
1
9
32
K
N
N
9
9
.
6
7
9
9
.
6
4
9
9
.
3
8
NN
9
9
.
9
9
1
0
0
.
0
0
9
9
.
9
7
M
I
B
-
2
0
1
6
17
S
V
M
9
9
.
8
4
9
9
.
6
0
1
0
0
.
0
K
N
N
9
8
.
5
8
9
8
.
9
0
9
9
.
2
8
NN
9
9
.
8
4
9
9
.
9
0
1
0
0
.
0
H
2
N
-
P
a
y
l
o
a
d
18
S
V
M
9
9
.
5
4
9
9
.
4
0
9
9
.
5
0
K
N
N
9
9
.
5
8
9
8
.
9
0
9
9
.
9
9
NN
9
9
.
4
4
9
9
.
4
0
9
9
.
3
0
4.
CO
NCLU
SI
O
N
T
h
e
ex
p
er
im
e
n
tal
r
esu
lts
d
em
o
n
s
tr
ate
th
at
th
e
SVM
al
g
o
r
ith
m
ac
h
iev
es
th
e
h
ig
h
e
s
t
o
v
er
all
class
if
icatio
n
p
er
f
o
r
m
a
n
ce
a
cr
o
s
s
th
e
ev
alu
ate
d
d
atasets
.
Sp
ec
if
ically
,
SVM
attain
ed
ac
cu
r
ac
y
r
ates
o
f
9
9
.
8
0
%
o
n
C
I
C
-
2
0
1
9
,
9
9
.
7
4
%
o
n
MI
B
-
2
0
1
6
,
an
d
9
9
.
6
4
%
o
n
H2
N
-
Pay
lo
ad
,
y
ield
i
n
g
an
av
er
ag
e
ac
cu
r
ac
y
o
f
9
9
.
7
3
%.
I
n
co
m
p
ar
is
o
n
,
th
e
KNN
alg
o
r
ith
m
ac
h
iev
ed
ac
c
u
r
ac
ies
o
f
9
9
.
7
1
,
9
1
.
6
6
,
an
d
9
4
.
0
6
%
o
n
th
e
s
am
e
d
atasets
,
r
esp
ec
tiv
ely
,
with
a
n
av
er
ag
e
o
f
9
5
.
1
4
%.
T
h
e
NN
m
o
d
el
also
p
er
f
o
r
m
ed
s
tr
o
n
g
l
y
,
with
ac
c
u
r
ac
ies
o
f
9
9
.
9
9
,
9
9
.
6
4
,
an
d
9
9
.
3
3
%,
r
es
u
ltin
g
in
an
a
v
er
ag
e
o
f
9
9
.
6
5
%.
Alth
o
u
g
h
th
e
NN
ac
h
iev
ed
th
e
h
ig
h
est ac
cu
r
ac
y
o
n
th
e
C
I
C
-
2
0
1
9
d
ataset,
SVM
d
em
o
n
s
tr
ated
th
e
m
o
s
t
co
n
s
is
ten
t
an
d
h
ig
h
est
av
er
a
g
e
p
e
r
f
o
r
m
a
n
ce
ac
r
o
s
s
all
th
r
ee
d
atasets
,
m
ak
in
g
it
th
e
b
est
-
p
er
f
o
r
m
i
n
g
alg
o
r
ith
m
in
th
is
s
tu
d
y
.
Fo
r
f
u
tu
r
e
wo
r
k
,
a
m
o
r
e
in
-
d
ep
t
h
in
v
esti
g
atio
n
u
s
in
g
ad
v
a
n
ce
d
d
ee
p
lear
n
in
g
a
r
ch
itectu
r
es
ap
p
lied
to
th
e
s
am
e
d
atasets
b
u
t
with
ex
ten
d
ed
o
r
alter
n
ativ
e
f
ea
tu
r
e
s
ets
co
u
ld
f
u
r
th
er
e
n
h
an
ce
DDo
S d
etec
tio
n
ca
p
ab
ilit
ies an
d
g
e
n
er
aliza
tio
n
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
2
5
2
-
8
9
3
8
I
n
t J Ar
tif
I
n
tell
,
Vo
l.
1
4
,
No
.
6
,
Dec
em
b
er
2
0
2
5
:
4
7
6
3
-
4
7
7
4
4772
ACK
NO
WL
E
DG
M
E
N
T
S
T
h
is
wo
r
k
was
s
u
p
p
o
r
ted
b
y
th
e
U
n
iv
er
s
iti
T
u
n
Hu
s
s
ein
On
n
Ma
lay
s
ia
(
UT
HM
)
th
r
o
u
g
h
T
ier
1
(
v
o
tQ5
0
8
)
an
d
also
r
ec
eiv
e
d
s
u
p
p
o
r
t f
r
o
m
i
n
d
u
s
tr
y
.
F
UNDING
I
NF
O
R
M
A
T
I
O
N
T
h
is
r
esea
r
ch
was
f
u
n
d
e
d
b
y
U
n
i
v
e
r
s
i
ti
T
u
n
H
u
s
s
e
in
On
n
M
ala
y
s
i
a
(
UT
HM
)
wit
h
g
r
a
n
t
n
u
m
b
e
r
v
o
tQ
5
0
8
a
n
d
s
u
p
p
o
r
t
ed
b
y
p
r
a
ctiti
o
n
e
r
s
f
r
o
m
i
n
d
u
s
tr
y
.
AUTHO
R
CO
NT
RI
B
UT
I
O
NS ST
A
T
E
M
E
N
T
T
h
is
jo
u
r
n
al
u
s
es
th
e
C
o
n
tr
ib
u
to
r
R
o
les
T
ax
o
n
o
m
y
(
C
R
ed
iT)
to
r
ec
o
g
n
ize
in
d
iv
id
u
al
au
th
o
r
co
n
tr
ib
u
tio
n
s
,
r
ed
u
ce
au
th
o
r
s
h
ip
d
is
p
u
tes,
an
d
f
ac
ilit
ate
co
llab
o
r
atio
n
.
Na
m
e
o
f
Aut
ho
r
C
M
So
Va
Fo
I
R
D
O
E
Vi
Su
P
Fu
An
d
i M
aslan
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
C
i
k
F
e
r
e
s
a
M
o
h
d
F
o
o
z
y
✓
✓
✓
✓
✓
✓
Kam
ar
u
d
d
in
Ma
lik
Mo
h
am
ad
✓
✓
✓
✓
✓
✓
Ab
d
u
l H
am
id
✓
✓
✓
✓
✓
✓
Ded
y
Fit
r
iawa
n
✓
✓
✓
✓
J
o
n
i H
asu
g
ian
✓
✓
✓
✓
✓
C
:
C
o
n
c
e
p
t
u
a
l
i
z
a
t
i
o
n
M
:
M
e
t
h
o
d
o
l
o
g
y
So
:
So
f
t
w
a
r
e
Va
:
Va
l
i
d
a
t
i
o
n
Fo
:
Fo
r
mal
a
n
a
l
y
s
i
s
I
:
I
n
v
e
s
t
i
g
a
t
i
o
n
R
:
R
e
so
u
r
c
e
s
D
:
D
a
t
a
C
u
r
a
t
i
o
n
O
:
W
r
i
t
i
n
g
-
O
r
i
g
i
n
a
l
D
r
a
f
t
E
:
W
r
i
t
i
n
g
-
R
e
v
i
e
w
&
E
d
i
t
i
n
g
Vi
:
Vi
su
a
l
i
z
a
t
i
o
n
Su
:
Su
p
e
r
v
i
s
i
o
n
P
:
P
r
o
j
e
c
t
a
d
mi
n
i
st
r
a
t
i
o
n
Fu
:
Fu
n
d
i
n
g
a
c
q
u
i
si
t
i
o
n
CO
NF
L
I
C
T
O
F
I
N
T
E
R
E
S
T
ST
A
T
E
M
E
NT
I
n
th
is
r
esear
ch
th
e
r
e
is
n
o
co
n
f
lict o
f
in
ter
est to
war
d
s
an
y
p
a
r
ty
.
DATA AV
AI
L
AB
I
L
I
T
Y
T
h
is
r
esear
ch
d
ata
is
a
v
ailab
le
o
n
th
e
o
f
f
icial
web
s
ite
o
f
th
e
Un
iv
er
s
ity
o
f
New
B
r
u
n
s
wick
(
UNB)
at
h
ttp
s
://www.
u
n
b
.
ca
/cic/d
atasets
/d
d
o
s
-
2
0
1
9
.
h
tm
l
,
wh
ich
p
r
o
v
id
es
r
ea
l
-
tim
e
d
ata
s
ets
r
elate
d
to
r
esear
ch
in
th
e
f
ield
o
f
n
etwo
r
k
s
ec
u
r
ity
.
RE
F
E
R
E
NC
E
S
[
1
]
S
.
S
a
m
b
a
n
g
i
,
L
.
G
o
n
d
i
,
a
n
d
S
.
A
l
j
a
w
a
r
n
e
h
,
“
A
f
e
a
t
u
r
e
s
i
m
i
l
a
r
i
t
y
m
a
c
h
i
n
e
l
e
a
r
n
i
n
g
m
o
d
e
l
f
o
r
D
D
o
S
a
t
t
a
c
k
d
e
t
e
c
t
i
o
n
i
n
m
o
d
e
r
n
n
e
t
w
o
r
k
e
n
v
i
r
o
n
m
e
n
t
s
f
o
r
i
n
d
u
s
t
r
y
4
.
0
,
”
C
o
m
p
u
t
e
r
s
a
n
d
E
l
e
c
t
r
i
c
a
l
E
n
g
i
n
e
e
r
i
n
g
,
v
o
l
.
1
0
0
,
2
0
2
2
,
d
o
i
:
1
0
.
1
0
1
6
/
j
.
c
o
m
p
e
l
e
c
e
n
g
.
2
0
2
2
.
1
0
7
9
5
5
.
[
2
]
A
.
K
h
r
a
i
sa
t
,
I
.
G
o
n
d
a
l
,
P
.
V
a
mp
l
e
w
,
a
n
d
J.
K
a
mr
u
z
z
a
ma
n
,
“
S
u
r
v
e
y
o
f
i
n
t
r
u
s
i
o
n
d
e
t
e
c
t
i
o
n
s
y
s
t
e
ms
:
t
e
c
h
n
i
q
u
e
s,
d
a
t
a
se
t
s
a
n
d
c
h
a
l
l
e
n
g
e
s,”
C
y
b
e
rse
c
u
r
i
t
y
,
v
o
l
.
2
,
n
o
.
1
,
2
0
1
9
,
d
o
i
:
1
0
.
1
1
8
6
/
s
4
2
4
0
0
-
019
-
0
0
3
8
-
7.
[
3
]
M
.
A
l
d
w
a
i
r
i
,
W
.
M
a
r
d
i
n
i
,
a
n
d
A
.
A
l
h
o
w
a
i
d
e
,
“
A
n
o
ma
l
y
p
a
y
l
o
a
d
s
i
g
n
a
t
u
r
e
g
e
n
e
r
a
t
i
o
n
s
y
st
e
m
b
a
se
d
o
n
e
f
f
i
c
i
e
n
t
t
o
k
e
n
i
z
a
t
i
o
n
met
h
o
d
o
l
o
g
y
,
”
I
n
t
e
r
n
a
t
i
o
n
a
l
J
o
u
r
n
a
l
o
n
C
o
m
m
u
n
i
c
a
t
i
o
n
s
A
n
t
e
n
n
a
a
n
d
Pr
o
p
a
g
a
t
i
o
n
,
v
o
l
.
8
,
n
o
.
5
,
p
p
.
4
2
1
–
4
2
9
,
2
0
1
8
,
d
o
i
:
1
0
.
1
5
8
6
6
/
i
r
e
c
a
p
.
v
8
i
5
.
1
2
7
9
4
.
[
4
]
I
.
M
a
su
d
,
K
.
K
u
sr
i
n
i
,
a
n
d
A
.
B
.
P
r
a
se
t
i
o
,
“
D
i
s
t
r
i
b
u
t
e
d
d
e
n
i
a
l
o
f
s
e
r
v
i
c
e
(
D
D
O
S
)
A
t
t
a
c
k
D
e
t
e
c
t
i
o
n
O
n
Zi
g
b
e
e
p
r
o
t
o
c
o
l
u
s
i
n
g
n
a
i
v
e
B
a
y
e
s
a
l
g
o
r
i
t
m
,
”
I
n
t
e
r
n
a
t
i
o
n
a
l
J
o
u
r
n
a
l
o
f
Ar
t
i
f
i
c
i
a
l
I
n
t
e
l
l
i
g
e
n
c
e
Re
se
a
r
c
h
,
v
o
l
.
5
,
n
o
.
2
,
p
p
.
1
5
7
–
1
6
7
,
2
0
2
1
,
d
o
i
:
1
0
.
2
9
0
9
9
/
i
j
a
i
r
.
v
5
i
2
.
2
1
4
.
[
5
]
M
.
Z
a
h
i
d
a
n
d
T.
S
.
B
h
a
r
a
t
i
,
“
En
h
a
n
c
i
n
g
c
y
b
e
r
s
e
c
u
r
i
t
y
i
n
I
o
T
sy
s
t
e
ms
:
a
h
y
b
r
i
d
d
e
e
p
l
e
a
r
n
i
n
g
a
p
p
r
o
a
c
h
f
o
r
r
e
a
l
‑
t
i
m
e
a
t
t
a
c
k
d
e
t
e
c
t
i
o
n
,”
D
i
sc
o
v
e
r I
n
t
e
rn
e
t
o
f
T
h
i
n
g
s
,
v
o
l
.
5
,
n
o
.
73
,
2
0
2
5
,
d
o
i
:
1
0
.
1
0
0
7
/
s
4
3
9
2
6
-
0
2
5
-
0
0
1
5
6
-
y
[
6
]
N
.
B
i
n
d
r
a
a
n
d
M
.
S
o
o
d
,
“
E
v
a
l
u
a
t
i
n
g
t
h
e
i
mp
a
c
t
o
f
f
e
a
t
u
r
e
se
l
e
c
t
i
o
n
me
t
h
o
d
s
o
n
t
h
e
p
e
r
f
o
r
ma
n
c
e
o
f
t
h
e
mac
h
i
n
e
l
e
a
r
n
i
n
g
m
o
d
e
l
s
i
n
d
e
t
e
c
t
i
n
g
D
D
o
S
a
t
t
a
c
k
s,
”
R
o
m
a
n
i
a
n
J
o
u
rn
a
l
o
f
I
n
f
o
rm
a
t
i
o
n
S
c
i
e
n
c
e
a
n
d
T
e
c
h
n
o
l
o
g
y
,
v
o
l
.
2
3
,
n
o
.
3
,
p
p
.
2
5
0
–
2
6
1
,
2
0
2
0
.
[
7
]
A
.
A
z
h
a
r
i
,
A
.
W
.
M
u
h
a
mm
a
d
,
a
n
d
C
.
F
.
M
.
F
o
o
z
y
,
“
M
a
c
h
i
n
e
l
e
a
r
n
i
n
g
-
b
a
s
e
d
d
i
s
t
r
i
b
u
t
e
d
d
e
n
i
a
l
o
f
ser
v
i
c
e
a
t
t
a
c
k
d
e
t
e
c
t
i
o
n
o
n
i
n
t
r
u
s
i
o
n
d
e
t
e
c
t
i
o
n
s
y
st
e
m
r
e
g
a
r
d
i
n
g
t
o
f
e
a
t
u
r
e
se
l
e
c
t
i
o
n
,
”
I
n
t
e
rn
a
t
i
o
n
a
l
J
o
u
rn
a
l
o
f
Ar
t
i
f
i
c
i
a
l
I
n
t
e
l
l
i
g
e
n
c
e
Re
se
a
r
c
h
,
v
o
l
.
4
,
n
o
.
1
,
p
p
.
1
–
8
,
2
0
2
0
,
d
o
i
:
1
0
.
2
9
0
9
9
/
i
j
a
i
r
.
v
4
i
1
.
1
5
6
.
[
8
]
J.
-
J.
K
i
m
,
Y
.
-
S
.
Le
e
,
J.
-
Y
.
M
o
o
n
,
a
n
d
J.
-
M
.
P
a
r
k
,
“
N
e
t
w
o
r
k
p
a
y
l
o
a
d
a
n
d
c
o
r
r
e
l
a
t
i
o
n
a
n
a
l
y
s
i
s
i
n
b
i
g
d
a
t
a
e
n
v
i
r
o
n
m
e
n
t
s,”
I
n
t
e
r
n
a
t
i
o
n
a
l
J
o
u
r
n
a
l
o
f
G
ri
d
a
n
d
D
i
s
t
ri
b
u
t
e
d
C
o
m
p
u
t
i
n
g
,
v
o
l
.
1
1
,
n
o
.
3
,
p
p
.
1
0
9
–
1
2
4
,
2
0
1
8
,
d
o
i
:
1
0
.
1
4
2
5
7
/
i
j
g
d
c
.
2
0
1
8
.
1
1
.
3
.
1
0
.
[
9
]
M
.
A
a
m
i
r
a
n
d
S
.
M
.
A
.
Za
i
d
i
,
“
C
l
u
s
t
e
r
i
n
g
b
a
se
d
sem
i
-
su
p
e
r
v
i
s
e
d
m
a
c
h
i
n
e
l
e
a
r
n
i
n
g
f
o
r
D
D
o
S
a
t
t
a
c
k
c
l
a
ss
i
f
i
c
a
t
i
o
n
,
”
J
o
u
rn
a
l
o
f
K
i
n
g
S
a
u
d
U
n
i
v
e
rsi
t
y
-
C
o
m
p
u
t
e
r
a
n
d
I
n
f
o
rm
a
t
i
o
n
S
c
i
e
n
c
e
s
,
v
o
l
.
3
3
,
n
o
.
4
,
p
p
.
4
3
6
–
4
4
6
,
2
0
2
1
,
d
o
i
:
1
0
.
1
0
1
6
/
j
.
j
k
s
u
c
i
.
2
0
1
9
.
0
2
.
0
0
3
.
[
1
0
]
M
.
A
r
sh
i
,
M
.
D
.
N
a
sr
e
e
n
,
a
n
d
K
.
M
a
d
h
a
v
i
,
“
A
s
u
r
v
e
y
o
f
D
D
O
S
a
t
t
a
c
k
s
u
s
i
n
g
ma
c
h
i
n
e
l
e
a
r
n
i
n
g
t
e
c
h
n
i
q
u
e
s,
”
i
n
E
3
S
We
b
o
f
C
o
n
f
e
re
n
c
e
s
,
2
0
2
0
,
d
o
i
:
1
0
.
1
0
5
1
/
e
3
s
c
o
n
f
/
2
0
2
0
1
8
4
0
1
0
5
2
.
Evaluation Warning : The document was created with Spire.PDF for Python.