Another parameter of interest is the analysis interval. While we recognize that two-minute interval provides sufficiently accurate results, we want to know how near real- time our method can detect DoS attacks. We measure detection accuracy as a function of analysis interval, shown in Table IV. The traffic used in the experiments is the same set as that in experiment IV-1.