# Technical Document Extraction: Flow Length Frequency Distribution
## 1. Image Overview
This image is a stacked bar chart (histogram) representing the frequency of network traffic flows categorized by their duration (Flow Length) and attack type. The Y-axis uses a logarithmic scale to accommodate a wide range of frequency values.
## 2. Component Isolation
### A. Header / Legend
The legend is located at the top center of the chart area, enclosed in a rounded rectangle. It maps seven categories to specific colors:
| Color | Label |
| :--- | :--- |
| Light Grey | **Web-Attack** |
| Yellow | **Infiltration** |
| Orange | **BoT** |
| Red | **DoS** |
| Purple | **BruteForce** |
| Blue | **DDoS** |
| Green | **Benign** |
### B. Axis Definitions
* **Y-Axis (Vertical):**
* **Label:** Frequency
* **Scale:** Logarithmic, ranging from $10^0$ (1) to $10^8$ (100,000,000).
* **Major Markers:** $10^0, 10^2, 10^4, 10^6, 10^8$.
* **X-Axis (Horizontal):**
* **Label:** Flow Length (Seconds)
* **Range:** 0 to 120 seconds.
* **Major Markers:** Every 5 units (0, 5, 10, 15, ..., 115, 120).
* **Tick Orientation:** Labels are rotated approximately 45 degrees.
## 3. Data Trends and Distribution
### General Trends
* **High Initial Frequency:** The highest frequency of flows occurs at the very beginning of the scale (0-2 seconds), reaching nearly $10^7$ total flows.
* **Logarithmic Decay:** There is a sharp decline in frequency as flow length increases from 0 to 10 seconds.
* **Steady State:** Between 10 and 110 seconds, the total frequency fluctuates but generally stays within the $10^4$ to $10^5$ range.
* **End-of-Scale Spike:** There is a notable increase in frequency for flows lasting between 110 and 120 seconds, particularly in the "Benign" and "DoS" categories.
### Category-Specific Observations
1. **Benign (Green):** This category is present across almost all flow lengths. It consistently forms the top layer of the stacks, indicating it is a primary component of the total traffic volume, especially for very short and very long flows.
2. **Web-Attack (Light Grey):** Highly concentrated in very short flows (0-5 seconds). It appears sporadically in longer flows (e.g., around 55-60s and 85s) but at much lower frequencies ($10^1$ to $10^2$).
3. **Infiltration (Yellow):** Shows a significant presence in short flows and maintains a relatively consistent baseline frequency (approx. $10^2$) across the entire 120-second spectrum.
4. **DoS (Red):** Becomes a dominant "attack" category for flows longer than 10 seconds. It shows periodic spikes, notably around the 30s, 55s, and 115s marks.
5. **DDoS (Blue):** Primarily visible in flows between 2 and 45 seconds. Its frequency is relatively stable within this range, typically sitting between $10^3$ and $10^4$.
6. **BoT (Orange) & BruteForce (Purple):** These are only visually significant in the very first bar (0-2 seconds). In longer flows, they are either non-existent or their frequency is too low to be visible on this scale compared to other categories.
## 4. Structural Data Extraction (Approximate Values)
| Flow Length (s) | Total Frequency (Approx) | Dominant Categories |
| :--- | :--- | :--- |
| **0** | $10^7$ | Benign, Infiltration, Web-Attack |
| **5** | $10^6$ | Benign, DoS, Infiltration |
| **20** | $5 \times 10^4$ | Benign, DDoS, DoS, Infiltration |
| **60** | $10^5$ | Benign, DoS, Infiltration |
| **90** | $10^4$ | Benign, DoS, Infiltration |
| **115** | $8 \times 10^5$ | Benign, DoS, Infiltration |
## 5. Language Declaration
The text in this image is entirely in **English**. No other languages are present.
