A Model to Partly but Reliably Distinguish DDOS Flood Traffic from Aggregated One

<table>The sample mean of <svg height="15.9125" id="M138" style="vertical-align:-2.57985pt" version="1.1" viewbox="0 0 28.0375 15.9125" width="28.0375" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<g transform="matrix(.017,-0,0,-.017,.062,12.638)"><path d="M425 682q0 -40 -49 -59q-36 -13 -110 -13q-31 -18 -52.5 -49.5t-21.5 -67.5q0 -34 17.5 -57.5t45.5 -28.5q63 15 97 15q18 0 18 -16q0 -13 -22 -36t-34 -23q-50 0 -93 8q-47 -20 -80.5 -66.5t-33.5 -96.5q0 -76 84 -103q33 -11 75 -21q101 -26 101 -93q0 -51 -39 -95.5
t-76 -68.5l-22 20q60 69 60 111q0 21 -14 34t-55 22q-21 4 -63 16q-68 19 -101.5 52.5t-33.5 96.5q0 125 157 206q-27 10 -46 36t-19 58q0 84 103 152q-43 3 -71.5 21t-28.5 45q0 37 65 59l17 -6q-9 -14 -9 -33q0 -21 17.5 -36t51.5 -19q82 53 147 53q18 0 18 -17z" id="x1D709"></path></g><g transform="matrix(.017,-0,0,-.017,7.678,12.638)"><path d="M300 -147l-18 -23q-106 71 -159 185.5t-53 254.5v1q0 139 53 252.5t159 186.5l18 -24q-74 -62 -115.5 -173.5t-41.5 -242.5q0 -130 41.5 -242.5t115.5 -174.5z" id="x28"></path></g><g transform="matrix(.017,-0,0,-.017,13.56,12.638)"><path d="M495 86q-46 -47 -87 -72.5t-63 -25.5q-43 0 -16 107l49 210q7 34 8 50.5t-3 21t-13 4.5q-35 0 -109.5 -72.5t-115.5 -140.5q-21 -75 -38 -159q-50 -10 -76 -21l-6 8l84 340q8 35 -4 35q-17 0 -67 -46l-15 26q44 44 85.5 70.5t64.5 26.5q35 0 10 -103l-24 -98h2
q42 56 97 103.5t96 71.5q46 26 74 26q9 0 16 -2.5t14 -11.5t9.5 -24.5t-1 -44t-13.5 -68.5q-30 -117 -47 -200q-4 -19 -3.5 -25t6.5 -6q21 0 70 48z" id="x1D45B"></path></g><g transform="matrix(.017,-0,0,-.017,22.093,12.638)"><path d="M275 270q0 -296 -211 -440l-19 23q75 62 116.5 174t41.5 243t-42 243t-116 173l19 24q211 -144 211 -440z" id="x29"></path></g>
</svg>.</table>

Mathematical Problems in Engineering

fig6

Figure 6

Figure 6: A Model to Partly but Reliably Distinguish DDOS Flood Traffic from Aggregated One 