## 3 Proposed Detection Mechanism
### Traffic Classification  
The detected suspicious traffic can be either an attack or an FC. In both cases, DDoS attack and FC, the mechanism detects abnormal traffic. Therefore, it is important to identify the nature of abnormal traffic. The FC traffic and DDoS attacks have a somewhat similar nature and disturb the network functionalities. However, the duration of FC might be shorter in many cases. These two anomalies have their own intentions and must be responded to separately. To classify these two types of anomalies, the Bayesian model is used. In this model, the variance in the sizes of payload and the packet reception time variance is considered. In the case of a DDoS attack, the time of each packet and its payload are important, as these keep some detectable traces. In a DDoS attack, these values are usually constant or equal to zero. However, in the case of FC, these values are random, or keep high variations. Using the Bayesian model, the posterior probabilities of both classes of abnormal traffic are calculated. Each packet having the maximum posterior probability belongs to its class. When the traffic is detected as FC, the flash nodes are not blocked by the BS. The FC nodes, once identified, can access the network services continuously without any intervention, while in the case of a detected DDoS attack, the mechanism can block the involved nodes by taking their IP addresses into the block list. Some key operations in the proposed mechanism are explained as follows:  
1. First, two different flows are captured at the BS node. The receiving time and payload sizes are considered, and arithmetic mean \(\mu\) and standard deviation \(\sigma\) are calculated, as shown in Equations (3) and (4). \[\mu=\sum_{i=1}^{n}\frac{h_{i}}{n}\] (3) \[\sigma=\sqrt{\sum_{i=1}^{n}\frac{(h_{i-}\mu)^{2}}{n}}\] (4) 2. After obtaining these values for two flows, the standard deviations of both are checked. The flow with a higher standard deviation should be considered as a flash flow, and the other one is marked as an attack flow. 3. Prior probabilities of both flows are computed by using Equations (5) and (6). In this equation, \(a\) denotes the number of packets class in the attack class, while \(fc\) is the total number of packets in the FC class. \[p[a]=\left[\frac{a}{fc+a}\right]\] (5) \[p[fc]=\left[\frac{fc}{fc+a}\right]\] (6) (d) Equations (7) and (8) are used to calculate the likelihood probability of a packet, whether an attack or \(FC\). This is based on the Gaussian probability density function. By using this equation, the probabilities for the size of payload and reception time are calculated. \[p^{\prime}\left[\frac{h}{a}\right]=\frac{1}{\sqrt{2\pi\sigma_{ha}^{2}}}\times e ^{-\frac{(hx-\mu)^{2}}{2\sigma_{ha}^{2}}}\] (7) \[p^{\prime}\left[\frac{h}{fc}\right]=\frac{1}{\sqrt{2\pi\sigma_{hf}^{2}}}\times e ^{-\frac{(hx-\mu)^{2}}{2\sigma_{hf}^{2}}}\] (8) (e) The packet's likelihood probability is obtained by taking multiplication of all the computed likelihood probabilities in Equations (9) and (10). \[p\left[\frac{h}{a}\right]=\prod_{i=1}^{n}pi^{i}\left[\frac{h_{i}}{a}\right]\] (9) \[p\left[\frac{h}{fc}\right]=\prod_{i=1}^{n}pi^{i}\left[\frac{h_{i}}{fc}\right]\] (10) (f) Finally, the posterior probabilities of both the classes, the DDoS attack and \(FC\), are computed by using [PERSON] theorem in Equations (8) and (9). \[p\left[\frac{fc}{h}\right]=\frac{p\left[\frac{h}{fc}\right]\times p[fc]}{p\left[ \frac{h}{fc}\right]\times p[fc]+p\left[\frac{h}{a}\right]\times p[a]}\] (11) \[p\left[\frac{a}{h}\right]=\frac{p\left[\frac{h}{a}\right]\times p[a]}{p\left[ \frac{h}{fc}\right]\times p[fc]+p\left[\frac{h}{a}\right]\times p[a]}\] (12) (g) In Equation (9), the computed posterior probabilities of both attack and \(FC\) are compared to judge whether the receiving packets are associated with an attack or \(FC\). \[\sigma=\sqrt{\sum_{i=1}^{n}\frac{(h_{i-}\mu)^{2}}{n}}\]0 (13) (h) In the class with a higher posterior probability, the packet is assumed to belong in that class. The procedure is explained by using Algorithms 1 and 2.