Abstract: For defending DDoS attacks effectively, the more information about the attacks is required. However, the present methods only stress the existence of attacks, so they are hard to indicate the attack protocols, attack density and attack patterns at one tim

Key words: Distributed denial of service attack, One-way connection density, Relative volume feature vector, Hypersphere multi-class svm