Advances, Systems and Applications
Table 3 Notation used in the work
From: An integrated SDN framework for early detection of DDoS attacks in cloud computing
Notation | Meaning | Notation | Meaning |
|---|---|---|---|
Model1 | Training flag for USIA feature | α1 and α2 | α1 as 0.1 and α2 as 0.8 |
Model2 | Training flag for NUDIA feature | f1(α1) and f2(α2) | Exponential filters α1 as 0.1 and α2 as 0.8 |
Z ← {z1, z2,…..,zt} | Timeseries of unique Source IP | Adf | Time series of distance between f1, f2 |
Y = {y1, y2, y3,….yt} | Time series of normalized Destination IP | M | Timeseries for rolling median of Adf |
ARIMA (p, d, q) | p is the lag order, d is the number of times raw observations differenced, and q is the order of Moving Averages (MA) | ldt | The minimum distance between items in M |
λt | Lyapunov exponent at time t | η | Threshold value |
pt | ARIMA model Prediction error at time t | q | The threshold is defined by the standard deviation number, σld |
Score1 and score2 | Anomaly prediction scores of Z and Y | σ | Standard deviation of ld |
α, | Exponential filter’s Smoothing constant | µ | Mean of the least distance |