## 3 Proposed Detection Mechanism
### Traffic Classification
```
1:Train Dataset
2:Normal, DDoS, FC
3:Begin
4:Incoming Known Traffic;
5:for\((i=1;i<Dataset.Length;i++)\)do
6:\(RL[i].IP\longleftarrow\)\(Pk.IP\) // Assignment to receiving list
7:\(RL[i].RT\longleftarrow\)\(Pk.RT\) // RT-receiving time
8:\(RL[i].PLS\longleftarrow\)\(Pk.PLS\) // Pls-payload size
9:\(RL[i].P\longleftarrow\)\(Pk\) // Packet assigned
10:endfor
11:for each \(i\) minute in \(RL.RT\)do
12:\(m(interval). [i]\longleftarrow\)\(Med\Big{(}\frac{No_{plts}}{SecinInminute}\Big{)}\)
13:endfor
14:\(m(slot)\longleftarrow\)\(Med(m(interval))\) // Median of all intervals
15:\(TH\longleftarrow\)\(m(slot)\) // Setting Threshold value
16:if\((Pkts<TH)\)then
17: Return \"Normal Flow\"
18:else
19:for\((i=1;i<2;i++)\)do
20:\(\mu F_{i}PM\longleftarrow\sum_{i=1}^{n}\frac{pkts[PLS_{i}]}{n}\) // mean calculation
21:\(\sigma F_{i}PS\longleftarrow\sqrt{\sum_{i=1}^{n}\frac{(PLS_{i}-pPLS)^{2}}{n}}\) // SD calculation
22:\(\mu F_{i}RM\longleftarrow\sum_{i=1}^{n}\frac{RT_{i}}{n}\)
23:\(\sigma F_{i}RS\longleftarrow\sqrt{\sum_{i=1}^{n}\frac{(RT_{i}-pRT)^{2}}{n}}\)
24:endfor
25:endif
26:\(class_{i}\longleftarrow\)\(P\Big{(}\frac{instance\_{i}class_{i}}{totalinstances}\Big{)}\)
27:\(p^{\prime}\Big{[}\frac{h}{a}\Big{]}=\frac{1}{\sqrt{2\pi\sigma_{hf}^{2}}}\times e ^{-\frac{(hx-h)^{2}}{2\sigma_{hf}^{2}}}\)
28:\(p^{\prime}\Big{[}\frac{h}{a}\Big{]}=\frac{1}{\sqrt{2\pi\sigma



that this algorithm has a linear time complexity because the running time is dependent upon the number of entries in the dataset. In this algorithm, up to step 8, the parameter values are taken from the inputted dataset. The loop in step 8 calculates the median of the number of packets for each minute. These are referred to as the medians of intervals. Step 12 calculates the median of all these computed medians. The ultimate median is considered as the threshold value at step 13. As per step 14, if the number of packets is less than the computed threshold value, it is considered as the normal flow. Otherwise, the means and standard deviations are calculated from step 17 to step 22. From step 24 to step 26, the classes are defined with the calculation of respective probabilities. ```
0: Test Dataset
0: Normal, DDoS, FC
1: Begin
2: Incoming Unknown Traffic;
3:if(\(\textit{Pkts}<TH\)) then
4: Return \"Normal Flow\"
5:else
6:for(\(i=1;i<Dataset.Length;i++\)) do
7:\(RL[i].\textit{IP}\longleftarrow\textit{Pi.IP}\)
8:\(RL[i].\textit{RT}\longleftarrow\textit{Pi.RT}\)
9:\(RL[i].\textit{PLS}\longleftarrow\textit{Pi.PLS}\)
10: Apply Classifier
11:\(p\left[\frac{d}{h}\right]=\frac{p\left[\frac{h}{h}\right]\times p\left[\frac {d}{h}\right]}{p\left[\frac{h}{h}\right]\times p\left[\frac{d}{h}\right]\times p \left[\frac{d}{h}\right]\times p\left[\frac{d}{h}\right]\times p\left[\frac{ d}{h}\right]\times p\left[\frac{d}{h}\right]\times p\left[\frac{d}{h}\right]}\)
12:\(p\left[\frac{fc}{h}\right]=\frac{p\left[\frac{f}{h}\right]\times p\left[ \frac{fc}{h}\right]}{p\left[\frac{d}{h}\right]\times p\left[\frac{d}{h} \right]\times p\left[\frac{d}{h}\right]\times p\left[\frac{d}{h}\right]\times p \left[\frac{d}{h}\right]\times p\left[\frac{d}{h}\right]}\)
13:if(\(p\left[\frac{d}{h}\right]>p\left[\frac{f}{h}\right]\)) then
14: Return \"DDoS\"
15:else
16: Return \"FC\"
17:endif
18:endfor
19:endif
20:End
```

**Algorithm 2** Testing

Algorithm 2 is used for test data. This algorithm has a loop, but statements are executed according to the number of records. Therefore, it has O(n) asymptotic time complexity. Some statements of this algorithm are similar to the previous one. The abnormal traffic is handled at step 5. The parameter values are taken at steps 7, 8, and 9. The probabilities are calculated at steps 11 and 12. As per the calculated probabilities, the DDoS or FC traffic are distinguished. ## 4 Simulation Results

The proposed work is simulated in NS2 [26], under Red Hat 7. AODV protocol [27] is taken as a base protocol. CAIDA--DDoS Attack 2007 and FIFA World Cup are two real-world datasets used in this research.