Table 8.
Resulting false discovery rate (FDR) of different types of signatures against part of the benign traffic. Signatures are part of the attack samples from the “Reconnaissance” category. The signatures are generated after a combination of packet direction and packet payload size.
Packet Sequence Length | |||||
---|---|---|---|---|---|
Direction | 4 | 6 | 8 | 10 | 12 |
Source → Destination | 62% | 0.9% | 0.7% | 0.3% | 0% |
Destination → Source | 65% | 15% | 0.1% | 0.5% | 0.3% |
Source ↔ Destination | 63% | 63% | 0.11% | 0.1% | 0% |