Algorithm 1. Event signature extraction

INPUT: $input pkgs$ = { $P_1$, $P_2$,…, $P_n$ }     Timestamp file: T = { $T_1$, $T_2$,…, $T_n$ }     event_trigger_time # Number of events triggered when collecting data OUTPUT: Event signature 1. get counter_list # counter_list save the pkg len in [Ti,Ti + 10s] 2. # example: counter_list = [[T1][P1.len,PK.len],[T2][][],...] 3. get pkg_occurance_num # pkg_occurance_num saves the number of trigger intervals with B 4. # pkg_occurance_num = [[len:P1.len][num:10],...] 5. for each pkg_num in pkg_occurance_num 6.  if pkg.num == event_trigger_time 7.    event_signature.key.append(pkg.len) 8.  if pkg.num >= event_trigger_time-5 9.    event_signature.high.append(pkg.len) 10. endfor 11. for each interval in interval list 12.  temp_min = Number of occurrences of elements in set event_signature in interval 13.  if temp_min < min 14.     event_signature.min = temp 15. endfor 16. for each interval in interval list 17.  temp_max_time = The maximum time between two packets in a signature in interval 18.  if temp_max_time > max_time 19.     event_signature.max_time = max_time 20. endfor