# Technical Document Extraction: Network Traffic Flow Length Distribution ## 1. Image Overview This image is a stacked bar chart representing the frequency of different network traffic categories based on their "Flow Length" in seconds. The Y-axis uses a logarithmic scale to accommodate a wide range of frequency values, from $10^0$ to $10^8$. ## 2. Component Isolation ### A. Header / Legend * **Location:** Top-center, enclosed in a black-bordered box. * **Categories (Color-Coded):** * **Theft:** Bright Pink * **Reconnaissance:** Light Pink / Lavender * **DDoS:** Blue * **DoS:** Red * **Benign:** Green ### B. Main Chart Area (Axes) * **Y-Axis (Vertical):** * **Label:** Frequency * **Scale:** Logarithmic ($10^0, 10^2, 10^4, 10^6, 10^8$) * **X-Axis (Horizontal):** * **Label:** Flow Length (Seconds) * **Range:** 0 to 120 seconds. * **Markers:** Major ticks every 5 units (0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, 100, 105, 110, 115, 120). ## 3. Data Analysis and Trends ### General Trends by Category 1. **Theft (Bright Pink):** Concentrated heavily at the very beginning of the timeline (0-5 seconds) with a peak frequency near $10^3$. It appears sporadically and at very low frequencies (near $10^0$) across the rest of the timeline. 2. **Reconnaissance (Light Pink):** Primarily occurs in the 0-10 second range. It shows a significant presence at 0 seconds (approx. $10^6$) and tapers off rapidly. 3. **Benign (Green):** Shows a relatively consistent baseline frequency between $10^1$ and $10^2$ across the entire 120-second duration, with a notable spike at the 115-120 second mark. 4. **DDoS (Blue):** Dominates the mid-range flow lengths. It rises sharply after 5 seconds, peaks between 10 and 25 seconds (reaching frequencies above $10^6$), and remains a major component until approximately 55 seconds. It shows isolated spikes later (e.g., at 65, 90, and 110 seconds). 5. **DoS (Red):** Becomes prominent starting around 15 seconds. It maintains high frequency (approx. $10^5$ to $10^6$) between 20 and 55 seconds, often stacked on top of DDoS traffic. It drops significantly after 60 seconds. ### Key Data Points (Estimated from Log Scale) | Flow Length (s) | Primary Category | Approx. Total Frequency | Observations | | :--- | :--- | :--- | :--- | | **0** | Reconnaissance / Theft | $> 10^6$ | Highest concentration of Reconnaissance. | | **10-15** | DDoS | $\approx 10^6$ | Sharp increase in DDoS activity. | | **25-40** | DDoS / DoS | $\approx 10^6$ | Sustained high-volume attack traffic. | | **50-55** | DoS / DDoS | $\approx 10^6$ | Final peak of sustained DoS/DDoS before drop-off. | | **60-110** | Mixed / Benign | $10^1 - 10^4$ | Significant drop in overall traffic; sporadic spikes. | | **110** | DDoS | $\approx 10^5$ | Late-stage isolated DDoS spike. | | **120** | Benign | $\approx 10^3$ | Significant Benign traffic at the end of the window. | ## 4. Summary of Findings The chart illustrates that different types of network events have distinct temporal signatures. **Reconnaissance** and **Theft** are "quick" events occurring almost instantaneously. **DDoS** and **DoS** attacks are characterized by sustained flows lasting between 10 and 60 seconds. **Benign** traffic is the most temporally diverse, appearing consistently across the entire measured spectrum but representing a lower volume compared to the peak of attack traffic.

# Technical Document Extraction: Flow Length Frequency Analysis ## Image Description The image is a **stacked bar chart** visualizing the distribution of network flow categories across different flow lengths (in seconds). The chart uses a **logarithmic y-axis** (Frequency) and a **linear x-axis** (Flow Length). Each bar is segmented by color to represent five categories: Theft, Reconnaissance, DDoS, DoS, and Benign. --- ## Key Components ### 1. **Axis Labels and Markers** - **X-Axis (Flow Length):** - Title: *"Flow Length (Seconds)"* - Range: 0 to 120 seconds (increments of 5 seconds). - Labels: 0, 5, 10, ..., 120. - **Y-Axis (Frequency):** - Title: *"Frequency"* - Scale: Logarithmic (10⁰ to 10⁸). - Labels: 10⁰, 10², 10⁴, 10⁶, 10⁸. ### 2. **Legend** - **Location:** Top-left corner. - **Categories and Colors:** - **Theft:** Pink - **Reconnaissance:** Purple - **DDoS:** Blue - **DoS:** Red - **Benign:** Green --- ## Data Trends and Observations ### 1. **Theft (Pink)** - **Trend:** Dominates **short flow lengths (0–20 seconds)**. - **Peak Frequency:** ~10⁶ at 0 seconds. - **Decline:** Rapidly decreases after 20 seconds, becoming negligible beyond 40 seconds. ### 2. **Reconnaissance (Purple)** - **Trend:** Secondary to Theft in short flows (0–20 seconds). - **Peak Frequency:** ~10⁵ at 0 seconds. - **Decline:** Gradual reduction after 20 seconds, fading by 40 seconds. ### 3. **DDoS (Blue)** - **Trend:** Peaks in **mid-range flows (50–70 seconds)**. - **Peak Frequency:** ~10⁷ at 60 seconds. - **Distribution:** Moderate presence in shorter flows (0–40 seconds), declines after 80 seconds. ### 4. **DoS (Red)** - **Trend:** Peaks in **mid-range flows (60–80 seconds)**. - **Peak Frequency:** ~10⁶ at 70 seconds. - **Distribution:** Moderate in shorter flows (0–50 seconds), declines after 90 seconds. ### 5. **Benign (Green)** - **Trend:** Dominates **long flow lengths (100–120 seconds)**. - **Peak Frequency:** ~10⁷ at 120 seconds. - **Distribution:** Minimal in short flows (0–50 seconds), increases steadily after 80 seconds. --- ## Spatial Grounding and Color Verification - **Legend Colors Match Bars:** - Pink (Theft) segments are tallest in 0–20s. - Blue (DDoS) segments dominate 50–70s. - Red (DoS) segments peak at 70s. - Green (Benign) segments grow tallest at 120s. --- ## Component Isolation - **Main Chart:** Stacked bars with logarithmic y-axis. - **Legend:** Top-left, no overlapping elements. - **No Footer/Header:** Chart focuses solely on data visualization. --- ## Conclusion The chart reveals distinct behavioral patterns for network flow categories: - **Short flows (0–40s):** Dominated by Theft and Reconnaissance. - **Mid-range flows (50–90s):** DDoS and DoS are most frequent. - **Long flows (100–120s):** Benign traffic prevails. No textual data tables or embedded diagrams are present. All information is derived from axis labels, legend, and bar segmentation.