A DDoS Attack Detection Method Based on SVM in Software Defined Network

Figure 5

Six-tuple eigenvalue trend.

(a) The speed of source IP per unit time

(b) The speed of source port per unit time

(c) The standard deviation of the number of flow packets in the period

(d) The standard deviation of the number of flow bits in the period

(e) The speed of flow entries per unit time

(f) The Ratio of Pair-Flow in the period