I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are
nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ])
Number of sources (
nSrcs) and number of destination (
nDsts) and other features are calculated for each aggregated flow according to destination IP (
IPdst) in this case, in a time slot. (Section 5.1 of [ 1 ])
But how is it possible for a web server which receives lots of flows from different sources (
nSrcs>1) to match with the mentioned DoS criteria. Maybe I don't understand what aggregation means here.
Reference: [ 1 ] Pedro Casas, Johan Mazel, Philippe Owezarski, Unsupervised Network Intrusion Detection Systems: Detecting the Unknown without Knowledge, Computer Communications, 2012.
Edit: Available at here. (This manuscript differs from the published one a little bit)
Edit: I asked the author, and answered this way:
"Everything is wrong with your reasonning as you consider basic traffic figures and not statistical figures. First, you need to learn about what an anomaly or a DoS attack is. Then, you have to learn about traffic statistics in the Internet... There are many papers on this written during the two last decades. Read them first."
what are statistical figures of network traffic?