What data should be collected if i want to bind two different DDoS-attacks?
In example i want to build a model, which will calculate the similarity of two DDoS-attacks.
The basic metrics should be:
- Similar IP`s;
- Similar attack rate and power;
- Similar attack type;
Is there any other metrics that can be taken into account?