: The Overall observations’ mean : A weighting factor, where 0 < 1 ≤ : The Standard deviation. : The width of the control limits. L Montgomery in [19] strongly recommended the use of the exact control limits in equations (3.12) and (3.14) for small values of This will greatly improve the i. performance of the control chart in detecting an off-target process immediately after the EWMA starts up [19]. EWMA is sometimes called a Geometric Moving Average (GMA), because the weights decline geometrically when connected by a smooth curve. The weight ( ) is a smoothing factor that controls the how quickly the old values are forgotten, so it is measure of the variability in order to capture important patterns and discard noise in the sample data. The width of the control limits ( ) are utilised to set the L threshold to detect an out of control process or most recent observation. EWMA has been used in other disciplines of science and research where the variables ( ) and ( ) have been used in different ways and with different values. Since the EWMA L chart implementation is sensitive to small shifts in the process, so choosing the previously mentioned factors can be a dilemma by itself. Some other researchers have investigated the issue of setting these factors with some recommendation, like in [19], [80], [117], and [116]. The recommendation is to assign the smoothing factor to 7/8 ( ), and = 7/8 0.9 λ ≈ the width of the control limits to 3 ( ) when used as an attack threshold alarm in L = 3 equation (3.12), which is notated as upper theta ( ), therefore an alert attention, which is Θ notated as lower theta ( ), is set to 2 ( ). L = 2 θ Statistical Process Control and Denial of Service A Real-Time Attack Detection and Prevention System for DDoS was designed in [131]. The designed research was based on per-IP Traffic Behavioural Analysis. A new
: The Overall observations’ mean : A weighting factor, where 0 < ≤ 1 : The Standard deviation. L : The width of the control limits. Montgomery in [19] strongly recommended the use of the exact control limits in equations (3.12) and (3.14) for small values of i. This will greatly improve the performance of the control chart in detecting an off-target process immediately after the EWMA starts up [19]. EWMA is sometimes called a Geometric Moving Average (GMA), because the weights decline geometrically when connected by a smooth curve. The weight ( ) is a smoothing factor that controls the how quickly the old values are forgotten, so it is measure of the variability in order to capture important patterns and discard noise in the sample data. The width of the control limits ( L ) are utilised to set the threshold to detect an out of control process or most recent observation. EWMA has been used in other disciplines of science and research where the variables ( ) and ( L ) have been used in different ways and with different values. Since the EWMA chart implementation is sensitive to small shifts in the process, so choosing the previously mentioned factors can be a dilemma by itself. Some other researchers have investigated the issue of setting these factors with some recommendation, like in [19], [80], [117], and [116]. The recommendation is to assign the smoothing factor to 7/8 ( λ = 7/8 ≈ 0.9 ), and the width of the control limits to 3 ( L = 3 ) when used as an attack threshold alarm in equation (3.12), which is notated as upper theta ( Θ ), therefore an alert attention, which is notated as lower theta ( θ ), is set to 2 ( L = 2 ). Statistical Process Control and Denial of Service A Real-Time Attack Detection and Prevention System for DDoS was designed in [131]. The designed research was based on per-IP Traffic Behavioural Analysis. A new
Detection%20of%20Denial%20Of%20Service%20Attacks%20on%20Application%20Layer%20Protocol.docx