A Model to Partly but Reliably Distinguish DDOS Flood Traffic from Aggregated One

Figure 2

Diagram of detection model.