Adaptive EWMA Method Based on Abnormal Network Traffic for LDoS Attacks

Table 2

The detection results of the Experiment I.

Number	Meet C1: APT>ΛAP	Meet C2: GPT>ΛGP	Judgment; (the LDoS attacks exist)
Group 1	None	None	None
Group 2	TW6, TW11	None	None
Group3	TW6 ∼TW11	TW6 ∼TW11	TW6 ∼TW11
Group 4	TW6 ∼TW11	TW6 ∼TW11	TW6 ∼TW11
Group 5	TW6 ∼TW11	TW6 ∼TW11	TW6 ∼TW11
Group 6	TW6 ∼TW11	TW6 ∼TW11	TW6 ∼TW11
Group 7	TW6 ∼TW11	TW6 ∼TW11	TW6 ∼TW11
Group 8	TW6 ∼TW11	TW6 ∼TW11	TW6 ∼TW11
Group 9	TW6 ∼TW11	TW6 ∼TW11	TW6 ∼TW11
Group 10	TW6 ∼TW11	TW6 ∼TW11	TW6∼TW11