412 The State of the Art in Intrusion Prevention and Detection
not developed. Work in [18] has established that threshold selection is an integral part of detection,
which is sometimes overlooked due to the time and effort required to tune the correct values. Even
in cases where this is done, the rst step is for a human to arbitrarily guess the correct level and then
tune based on trafc. Nonetheless, these factors are not always taken into consideration in ooding
investigations as observed in [19].
Factors that impact on the performance of a DoS attack are listed in [12] as attack duration,
attack rate, and average processing time for a frame. Research carried out in [12,14,15], however,
suggests that these are not the only relevant factors ...