Abstract: Distributed Denial of Service (DDoS) attacks are still making networks less available, so detection needs to be able to tell the difference between real flash-crowds and fake ones with very ...