## 3 Proposed Detection Mechanism
### Traffic Classification
The means and standard deviations of receiving time and sizes of payload of both types of traffic were calculated. The class with maximum standard deviation was labeled as FC, while the other one was DDoS attack. The Bayesian model takes these means and standard deviations for classification of irregular traffic further in attack and FC traffic. The proposed system identified that 14 nodes are flash and 6 are attacker nodes in 20 suspicious nodes. Tables 4 and 5 show the discrimination of DDoS attack from FC traffic computed from interarrival time variance and size of payload variance. The same are also represented by Figures 4 and 5. The dataset used for these two types of traffic is shown in Table 6.

### Second Experiment

A second experiment was performed based on 40 nodes to evaluate the proposed mechanism's performance for abnormal and normal traffic categorization. The proposed mechanism identified 15 as normal and 25 as suspicious nodes. Figure 6 shows the categorization of traffic in normal and abnormal traffic. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Type** & **IPs** & \(\sigma(\textit{PLsSize})\) & \(\sigma(\textit{Time})\) & \(\mu(\textit{PLsSize})\) & \(\mu(\textit{Time})\) \\ \hline FC & 14 & 18.1818 & 0.0285 & 490.33 & 0.0472 \\ DDoS & 6 & 10.0484 & 0.00780 & 500.83 & 0.00742 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: DDoS and FC traffic classification. Figure 4: Discrimination of DDoS attack from FC based on IAT. Figure 5: Discrimination of DDoS attack from FC based on the size of payload. ### Classification of Traffic

The suspicious nodes were further classified as attacker and flash nodes. Flash nodes have data rates of 20 kbps to 40 kbps and attacker nodes'data rates vary from 25 kbps to 45 kbps. Means and standard deviations of payload size and receiving time of payload size were calculated. The class with maximum standard deviation was labeled as FC while the other one was DDoS attack. The Bayesian model takes these means and standard deviations for classification. The proposed mechanism identified 15 nodes as flash and 10 as attacker nodes. Table 7 shows the dataset for these two types of traffic. The graphs in Figures 7 and 8 show the classification of traffic based on interarrival time variance and payload size variance. ## 5 Simulation Results by Using Real Datasets

For further evaluation, two real-world datasets were also used. These datasets are \"1998 FIFA World-Cup\" [28] for FC data and \"CAIDA DDoS Attack 2007\" [29] as DDoS data. From the CAIDA dataset, one minute (4 August 2007 from 05:30 to 05:31) of traffic data was selected. From the FIFA World cup dataset, one hour (10:06:1998; 15:00 to 16:00) was selected. In one hour of the CAIDA attack dataset, 359,655,826 request packets were generated, while in one minute, this value was 296,361. Similarly, in the FIFA World Cup, 253,830 request packets were generated in one hour. In this dataset, the requests are produced from legitimate web clients to the FIFA website. Table 8 shows the computed parameters in this experiment. Figures 9 and 10 show the results for traffic classes from the two real datasets. It is noted that the packets are almost the same sizes as in the case of the attack packets. In addition, the arrival time for such packets is less. The dataset records show that the attack packets are merely produced and transmitted. These data packets do not carry data and do not need any time for transmission. In the case of the FIFA World Cup dataset, the generated packets are of different sizes and their interarrival times are also not in the same pattern. Figure 8: Discrimination based on the size of payload. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Type** & **IPs** & \(\mathbf{\sigma(PLsSize)}\) & \(\mathbf{\sigma(Time)}\) & \(\mathbf{\mu(PLsSize)}\) & \(\mathbf{\mu(Time)}\) \\ \hline FIFA World Cup & 8106 & 6130.3 & 0.3498 & 10,055.1 & 27.8181 \\ CAIDA DDoS & 5556 & 0.90 & 0.001123 & 60.8 & 0.0048 \\ \hline \hline \end{tabular}
\end{table}