# Technical Document Extraction: Flow Length Frequency Distribution ## 1. Image Overview This image is a stacked bar chart (histogram) representing the frequency of network traffic flows categorized by their duration (Flow Length) and attack type. The Y-axis uses a logarithmic scale to accommodate a wide range of frequency values. ## 2. Component Isolation ### A. Header / Legend The legend is located at the top center of the chart area, enclosed in a rounded rectangle. It maps seven categories to specific colors: | Color | Label | | :--- | :--- | | Light Grey | **Web-Attack** | | Yellow | **Infiltration** | | Orange | **BoT** | | Red | **DoS** | | Purple | **BruteForce** | | Blue | **DDoS** | | Green | **Benign** | ### B. Axis Definitions * **Y-Axis (Vertical):** * **Label:** Frequency * **Scale:** Logarithmic, ranging from $10^0$ (1) to $10^8$ (100,000,000). * **Major Markers:** $10^0, 10^2, 10^4, 10^6, 10^8$. * **X-Axis (Horizontal):** * **Label:** Flow Length (Seconds) * **Range:** 0 to 120 seconds. * **Major Markers:** Every 5 units (0, 5, 10, 15, ..., 115, 120). * **Tick Orientation:** Labels are rotated approximately 45 degrees. ## 3. Data Trends and Distribution ### General Trends * **High Initial Frequency:** The highest frequency of flows occurs at the very beginning of the scale (0-2 seconds), reaching nearly $10^7$ total flows. * **Logarithmic Decay:** There is a sharp decline in frequency as flow length increases from 0 to 10 seconds. * **Steady State:** Between 10 and 110 seconds, the total frequency fluctuates but generally stays within the $10^4$ to $10^5$ range. * **End-of-Scale Spike:** There is a notable increase in frequency for flows lasting between 110 and 120 seconds, particularly in the "Benign" and "DoS" categories. ### Category-Specific Observations 1. **Benign (Green):** This category is present across almost all flow lengths. It consistently forms the top layer of the stacks, indicating it is a primary component of the total traffic volume, especially for very short and very long flows. 2. **Web-Attack (Light Grey):** Highly concentrated in very short flows (0-5 seconds). It appears sporadically in longer flows (e.g., around 55-60s and 85s) but at much lower frequencies ($10^1$ to $10^2$). 3. **Infiltration (Yellow):** Shows a significant presence in short flows and maintains a relatively consistent baseline frequency (approx. $10^2$) across the entire 120-second spectrum. 4. **DoS (Red):** Becomes a dominant "attack" category for flows longer than 10 seconds. It shows periodic spikes, notably around the 30s, 55s, and 115s marks. 5. **DDoS (Blue):** Primarily visible in flows between 2 and 45 seconds. Its frequency is relatively stable within this range, typically sitting between $10^3$ and $10^4$. 6. **BoT (Orange) & BruteForce (Purple):** These are only visually significant in the very first bar (0-2 seconds). In longer flows, they are either non-existent or their frequency is too low to be visible on this scale compared to other categories. ## 4. Structural Data Extraction (Approximate Values) | Flow Length (s) | Total Frequency (Approx) | Dominant Categories | | :--- | :--- | :--- | | **0** | $10^7$ | Benign, Infiltration, Web-Attack | | **5** | $10^6$ | Benign, DoS, Infiltration | | **20** | $5 \times 10^4$ | Benign, DDoS, DoS, Infiltration | | **60** | $10^5$ | Benign, DoS, Infiltration | | **90** | $10^4$ | Benign, DoS, Infiltration | | **115** | $8 \times 10^5$ | Benign, DoS, Infiltration | ## 5. Language Declaration The text in this image is entirely in **English**. No other languages are present.