Accurately Identifying New QoS Violation Driven by High-Distributed Low-Rate Denial of Service Attacks Based on Multiple Observed Features

<div>Comparison of output <svg height="11.5564pt" id="M102" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 27.6194 11.5564" width="27.6194pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M238 0V26C174 32 166 38 166 104V712C132 700 70 683 18 677V653C81 647 87 645 87 577V104C87 38 78 32 15 26V0H238Z" id="g121-106"></path><glyph.data ascent="989" descent="-360" horiz-adv-x="253" vert-adv-y="253"></glyph.data></g><g transform="matrix(.013,0,0,-0.013,3.289,0)"><path d="M524 0V26C466 32 460 36 460 104V297C460 393 411 449 331 449C302 449 276 437 248 419C223 402 201 387 181 372V451C137 432 90 420 42 411V388C96 378 102 374 102 310V104C102 38 97 33 29 26V0H246V26C187 32 181 36 181 104V339C211 365 250 390 290 390C357 390 381 345 381 276V109C381 40 374 32 315 26V0H524Z" id="g121-108"></path><glyph.data ascent="989" descent="-360" horiz-adv-x="547" vert-adv-y="547"></glyph.data></g><g transform="matrix(.013,0,0,-0.013,10.4,0)"><path d="M300 -147C201 -63 143 98 143 270S200 602 300 686L282 710C136 610 70 450 70 271V270C70 89 136 -72 282 -170L300 -147Z" id="g113-41"></path><glyph.data ascent="3473" descent="-2876" horiz-adv-x="346" vert-adv-y="346"></glyph.data></g><g transform="matrix(.013,0,0,-0.013,14.898,0)"><path d="M600 480C600 590 528 650 384 650H143L137 622C222 614 225 607 210 531L130 127C113 41 106 36 23 28L17 0H294L300 28C204 36 195 42 212 127L243 284L314 263C327 263 339 263 352 264C465 271 600 337 600 480ZM508 481C508 351 402 304 329 304C289 304 265 311 250 317L295 559C302 594 310 606 323 611C335 616 350 619 367 619C455 619 508 573 508 481Z" id="g113-81"></path><glyph.data ascent="3473" descent="-2876" horiz-adv-x="617" vert-adv-y="617"></glyph.data></g><g transform="matrix(.013,0,0,-0.013,22.924,0)"><path d="M275 270C275 450 212 609 64 710L45 686C145 604 203 442 203 270S147 -63 45 -147L64 -170C213 -68 275 89 275 270Z" id="g113-42"></path><glyph.data ascent="3473" descent="-2876" horiz-adv-x="346" vert-adv-y="346"></glyph.data></g></svg> of TF-HMM in normal and in attack flow.</div>

Journal of Sensors

fig5

Figure 5

Figure 5: Accurately Identifying New QoS Violation Driven by High-Distributed Low-Rate Denial of Service Attacks Based on Multiple Observed Features 