OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN

Figure 9

The coarse-grained detection results during a SYN flood attack [18]: (a) byte rate and volume metric of byte in monitored flow; (b) packet rate and volume metric of packet in monitored flow; (c) byte count asymmetry and asymmetry metric of byte in monitored pair-flow; (d) packet count asymmetry and asymmetry metric of packet in monitored pair-flow.

(a)

(b)

(c)

(d)