Fig. 3From: Detection of spoofed and non-spoofed DDoS attacks and discriminating them from flash crowdsTimeline showing attack start time, attack detected time, and the delay. It shows network state. At the time ta, DDoS is started and at the time td, the attack is detectedBack to article page