RT-SAD: Real-Time Sketch-Based Adaptive DDoS Detection for ISP Network

Table 1

Function of sketch.

Sketch name	Meaning	Function
Stat_Asym	The asymmetric flow features of destination IP	To complete the statistical function of feature in a single time window
Stat_Exist	The existence of SIP and DIP
Detect_Asym	The feature value in the attack detection window	To provide the judgment conditions for the attack detection module to work
Detect_Pred	The predicted value in the attack detection window
Detect_Thld	The threshold value in the attack detection window