Low-Rate DDoS Attack Detection Using Expectation of Packet Size

Figure 3

The legitimate-traffic scenario sampled from 12:30 to 12:45 in 2007-01-10.