Note the rich structure and similarities within a service type that are available for classification of flows. These are various flows for email. These are various flows for telnet. These are various flows for secure shell. These are various flows for rlogin.
Attackers often use hosts as intermediaries, or relays, to hide their true network locations.
We capture a flow structure by binning the relationship between packet size and interpacket delay. A few packet sizes are binned individually because of their high frequency and special use. The rest are binned in intervals. Each flow is characterized with a vector of 288 counts. PC is a technique that uses the high dimensional flow characteristics and provides orthogonal linear combinations that iteratively capture the direction of greatest variation.