Low-Rate DDoS Attack Detection Using Expectation of Packet Size

Figure 19

The distances between the EPSs of the legitimate traffic and the EPSVs of the pulsing attack traffic samples with high packet rates.