2XU K, ZHANG Z L, BHATTACHARYYA S. Intemet traffic behavior profiling for network security monitoring[J]. IEEE/ACM Transactions on Networking, 2008, 16(6):1241-1252.
3LAKHINA A, CROVELLA M, DIOT C. Mining anomalies using traffic feature distrlbutlons[A]. SIGCOMM[C]. Philadelphia, Pennsylvania, USA, 2005.134-145.
4TORRES R, HAJJAT M, RAO SG, et al. Inferring undesirable behavior fiom P2P traffic analysis[A]. SIGMETRICS[C]. USA, 2009. 231-242.
5GU G, PERDISCI R, ZHANG J, et al. BotMiner: clustering analysis of network traffic for protocol and structure-independent botnet detection[A]. USENIX Security[C]. USA., 2008.67-76.
6DENNING D. An intrusion-detection model[J]. IEEE Transactions on Software Engineering, 1987, 13(2):222-232.
7SOULE A, SALAMATIAN K E, TAFT N. Combining filtering and statistical methods for anomaly detection[A]. IMC[C]. Boston, USA, 2005. 311-322.
8LI M, LI J, ZHAO W. Experimental study of DDOS attacking of flood Type based on NS2[J]. Int J Electronics and Computers, 2009, 1(2): 143-152.
9LI M. Change trend of averaged hurst parameter of traffic under DDOS flood attacks[J). Computers & Security,2006, 25(3): 213-220.
10VARDI. Network Tomography: Estimating source-destination traffic intensities from link data[J]. Journal of the American Statistical Association, 1996, 91(2): 365-377.
