“…First, the attackers use networks to perform denial of service (DoS) attacks and distributed denial of service (DDoS) attacks as a way to attack network availability. DoS and DDoS attacks [17,53] include ping of death and others, synchronize (SYN) flooding, and Hypertext Transfer Protocol (HTTP). In this case, by obtaining detection information, e.g., APT alert output from different attack detection sensors in APTALCM [26]: timestamp, alert type, Src Ip, Dest_Ip, Src_Port, Dest Port, and Victim_HostIp, they make a vector dimensional A(I(alert)m) = (a1, a2, a3, a4, a5, a6, a7).…”