For accurate TCP/IP traffic identification, both the IP source address and TCP destination port address attributes are required, which are collectively referred to as classifier attributes as their key function is to label each flow. Since Slowloris is renowned for exploiting the connection session between client and server, the packet length and TCP delta time attributes (see Table 1) are the primary focus of the analysis. Thus, two attributes are used for identification of TCP/IP streams, and two attributes to detect the Slow DoS attack. A comparative analysis of Slow DoS packet lengths is given in \cite{23}, whilst \cite{24} evaluated the variance of delta times on the basis that Slowloris exploits the web server wait and timeout parameters. This means the connection must be held open until the timeout value expires, so a longer than normal delta time value is a valuable indicator of a possible Slowloris attack. The next section contextualises the new real-time Slow DoS detection framework, with Slowloris as the MN attack mechanism.

\begin{figure}
\centering
\includegraphics{figure_2.pdf}
\caption{Slowloris Detection Flowchart}
\label{figure_2}
\end{figure}

\subsection{A. Slow DoS Detection Framework}
This two-step framework involves just four attributes being extracted at the ingress point of the network to permit real-time packet inspection. This not only expedites MN detection, but avoids the inherent requirement of existing collaborative detection approaches or using post event (off-node) ML-based methods. A flowchart of the detection framework is shown in Fig.~\ref{fig:figure_2}. Step 1 examines all inbound SN, LN and MN packets destined for port \#80, using three attributes. As previously mentioned, two of these relate to packet classification, namely the source IP address and destination port pairs. The third attribute is the packet length $l_p$ where a range of non-characteristic $l_p$ values are analysed, and if germane, labelled as candidate MN for further scrutiny.

As Slowloris attacks hold TCP connections open without requesting data, MN packets have a smaller payload compared to SN and LN packets, so these have a commensurate impact on the overall packet length. The first detection step thus seeks to identify abnormally sized packets which are labelled as candidate MN prior to them undergoing further validation in Step 2 of Fig.~\ref{fig:figure_2}. The second step applies a fourth attribute to the candidate MN list, namely the TCP delta time $\Delta t$, which measures the time elapsed between non-contiguous TCP connections. This attribute records the inter-frame arrival times $\Delta t$, which is the time frame between the end of one packet and start of the next. Since Slowloris attacks invoke recurring connections during an attack period, $\Delta t$ analysis is used to identify anomalous frequencies in transmissions from the candidate MN which have been distilled from Step 1.

\section{IV. Results Discussion}
Legitimate TCP/IP $l_p$ values can be highly variable in nature depending on their origin, the application payload and the underlying protocol used, i.e., HTTP or FTP (File Transfer Protocol). For the analysis here the TCP/IP length, $l_p$ includes a full byte count of each TCP/IP packet. Fundamental to packet analysis are the SYN (synchronise) and ACK (acknowledge) flags, which are required for creating legitimate TCP bidirectional connections, along with the PSH (push) flag, which informs the server to send data. In the case of a Slowloris attack, once a connection is opened, the MN requests further data with the express purpose of keeping the TCP connection open. Since Slowloris attacks closely resemble LN requests, the first set of experiments investigated the variance in TCP/IP packet lengths that target application port \#80 of the web server, so an accurate and reliable detection strategy can be formulated which not only discriminates LN from MN, but crucially, also can differentiate SN from MN.

\subsection{A. Packet Length Analysis}
The corresponding $l_p$ variance results are displayed in Fig.~3 from which it is observed that packets in the range [40, 79] bytes occur with the highest frequency. This particular range, which contains both SYN and ACK packets, has the highest proportion of traffic, with LN, SN and MN traffic appearing similar, so corroborating the judgement \cite{16} that Slow DoS attack detection for reliable IDS is problematic when attempting to differentiate between LN and MN, with SN often being misclassified as Slow DoS attacks.

A study of the mid-range $l_p$ values reveals that MN generated packets recorded in the [80, 159] byte range constitute $\approx 13\%$ of all MN traffic, with an average packet length being 96.4 bytes, while for the LN and SN tested, there is a notable absence of packets within this range. By considering the next range of interest, [160, 319] bytes, the corresponding results reveal that $\approx 14\%$ of MN packets lie in this range, in contrast to LN and SN traffic which both have much lower occurrences, with neither exceeding $4\%$.

When combining these two packet ranges i.e. [80, 319] bytes, MN analysis indicates that $\approx 27\%$ of all packets are recorded in this range, which is a significantly higher than for each LN and SN tested. This provides a heuristic threshold for labelling such traffic as candidate MN.

A critical evaluation of the Slowloris attack traffic revealed the presence of open TCP connections where response requests