# Technical Data Extraction: Network Traffic Flow Analysis
## 1. Document Overview
This image is a line graph depicting network traffic volume over time, categorized by traffic type. The y-axis uses a logarithmic scale to represent the number of flows, while the x-axis represents time in minutes.
## 2. Component Isolation
### A. Header / Metadata
* **Title:** None present in the image.
* **Legend Location:** Top-center, enclosed in a black border.
* **Green Line:** Benign
* **Blue Line:** DDoS
* **Red Line:** DoS
### B. Axis Specifications
* **Y-Axis (Vertical):**
* **Label:** "Number of Flows"
* **Scale:** Logarithmic ($10^0$ to $10^6$).
* **Major Markers:** $10^0, 10^1, 10^2, 10^3, 10^4, 10^5, 10^6$.
* **X-Axis (Horizontal):**
* **Label:** "Time in minutes"
* **Scale:** Linear (0 to 800).
* **Major Markers:** 0, 100, 200, 300, 400, 500, 600, 700, 800 (labels are rotated approximately 45 degrees).
### C. Main Chart Area
* **Grid:** Major grid lines are present for both axes.
* **Data Range:** Active data is only present between $t=0$ and approximately $t=260$ minutes. The remainder of the chart (300–800 minutes) is empty.
---
## 3. Data Series Analysis and Trends
### Series 1: Benign (Green Line)
* **Visual Trend:** This series represents the baseline traffic. It maintains a relatively constant, low-volume "jitter" throughout the active period.
* **Data Characteristics:**
* **Baseline:** Fluctuates primarily between $10^1$ (10 flows) and just below $10^2$ (approx. 30-50 flows).
* **Duration:** Continuous from $t=0$ to $t \approx 260$.
* **Notable Spikes:** A small initial spike at $t \approx 5$ reaching nearly $10^2$.
### Series 2: DoS (Red Line)
* **Visual Trend:** Characterized by high-magnitude, "blocky" bursts of activity followed by sharp drops to zero.
* **Data Characteristics:**
* **Burst 1:** Starts at $t \approx 0$, sustains at $\approx 10^5$ flows, ends at $t \approx 45$.
* **Burst 2:** Starts at $t \approx 55$, sustains at $\approx 10^5$ flows, ends at $t \approx 90$.
* **Burst 3 (Lower Intensity):** Starts at $t \approx 100$, sustains at $\approx 10^3$ flows, ends at $t \approx 120$.
* **Inactivity:** Drops to $10^0$ or below (off-chart) between bursts and after $t=120$.
### Series 3: DDoS (Blue Line)
* **Visual Trend:** Similar to the DoS series but occurs later in the timeline. It shows high-volume sustained activity with significant internal volatility.
* **Data Characteristics:**
* **Primary Burst:** Starts at $t \approx 140$, sustains between $10^4$ and $2 \times 10^5$ flows.
* **Internal Drops:** Sharp, momentary drops to baseline levels occur at $t \approx 180$ and $t \approx 210$.
* **Tailing Off:** At $t \approx 220$, the volume drops to a lower plateau of $\approx 10^3$ flows before terminating at $t \approx 245$.
---
## 4. Summary Table of Events
| Time Interval (min) | Dominant Traffic Type | Approx. Flow Magnitude |
| :--- | :--- | :--- |
| 0 - 45 | **DoS** (Red) | $10^5$ |
| 45 - 55 | Benign (Green) | $10^1$ |
| 55 - 90 | **DoS** (Red) | $10^5$ |
| 100 - 120 | **DoS** (Red) | $10^3$ |
| 140 - 220 | **DDoS** (Blue) | $10^4 - 10^5$ |
| 220 - 245 | **DDoS** (Blue) | $10^3$ |
| 260 - 800 | None | N/A |
## 5. Language Declaration
The text in this image is entirely in **English**. No other languages were detected.
