Fig. 1
From: Anomaly detection through information sharing under different topologies
Demonstration of dynamic thresholds and the perceived attack state by a node. The red line represents the traffic count through the node, as a function of time. The lower threshold s L is fixed, but the upper threshold s t decreases when traffic exceeds its value, and it increases when traffic is lower than that. In each of the three areas defined by the two thresholds, the perceived threat level of the node assumes the value of either T = 0, T = 1, or T = 2