4 ms·

Looking at that graph, there is way too much scatter / too little data in order to plot clean exponential fits like that. A linear model would likrly fit the da

Looking at that graph, there is way too much scatter / too little data in order to plot clean exponential fits like that. A linear model would likrly fit the data just as good. At least throw on some bands indicating uncertainty in the fit.

1propionyl 6y ago
There are three distinct series of data (indicated by color) there. Looking at each individually I have to disagree. They look like perfectly kosher (and in fact good) exponential fits. Bands would still be nice though.
- X6S1x6Okd1st 6y ago
  The bits per second one doesn't have any points for the past 5 years?! It's by far the scariest one if you just look at the graph
  - mediaman 6y ago
    I agree. It's better to cut off the line past the point where it no longer has any data to support it. In this case it's about 2.5 years of missing data that is substantiating a claim of 2x+ increase during the same time. It's reasonable to say it had an exponential function up until two years ago, and we don't know what it was since then. R squared doesn't capture that inaccuracy because there is no data to compare it against during the scary time period in question. It's just a line in a void.
    - cutemonster 6y ago
      > cut off the line Or change to thin dashed line when no more data
menscher 6y ago
The trend-lines were really just to guide the eye (the text gives this context), but if you really must know: the R^2 for all three fits was above 0.9, suggesting the exponential growth model is reasonable. As you say, the pps and bps don't show much curvature, so a linear fit could indeed work for them for the displayed portion of the graph. But it's non-sensical when you look further back in time... predicting negative attack volumes prior to mid-2011. ;)
- mlthoughts2018 6y ago
  The criticism that it would go negative in the past is meaningless. Of course it’s unphysical, but that doesn’t mean a linear model isn’t appropriate for today’s data. You would just choose a point of time in the past where you believe the model is inapplicable. Maybe it was a different linear model then, or maybe mostly constant, who cares, we’re modeling today’s range of data, which might be well explained by a linear model, doesn’t really matter what 2011’s data was doing unless we separately believe the same growth law had to apply across all the years, and I see no reason why.
- jackpirate 6y ago
  Another alternative model besides linear would be quadratic (or another X^(1+epsilon) polynomial where epsilon is small). This would avoid the problem of negative data and likely fit the data better than an exponential.
  - sdenton4 6y ago
    But why? I think the question is really about the growth of volume of connected, compromised devices. Growth curves are often sigmoid shaped, meaning, exponential until they're not. The exponential is often great for modeling growth trends up until the plateau, but it's hard to know when the corner will turn. Exponentials are also well motivated by differential equations... (Say, if you're modeling growth of IOT devices based on word of mouth.) Polynomials with degree 1+epsilon, less so.
    - cutemonster 6y ago
      Exactly. I wonder why some people seem to want other equations instead, how is that better
- yjftsjthsd-h 6y ago
  > The trend-lines were really just to guide the eye That's the problem, no? You can draw a line/curve over any data and convince a lot of people that it's relevant, but that's more cognitive bias than anything.
deleted 6y ago
[deleted]
howlgarnish 6y ago
Internet bandwidth growth is known to be exponential, so it would be odd if not dangerous to assume that DDoS volumes are not.
ekianjo 6y ago
That does not look like exponential growth at all.

1propionyl 6y ago

There are three distinct series of data (indicated by color) there. Looking at each individually I have to disagree. They look like perfectly kosher (and in fact good) exponential fits. Bands would still be nice though.

X6S1x6Okd1st 6y ago
The bits per second one doesn't have any points for the past 5 years?! It's by far the scariest one if you just look at the graph
- mediaman 6y ago
  I agree. It's better to cut off the line past the point where it no longer has any data to support it. In this case it's about 2.5 years of missing data that is substantiating a claim of 2x+ increase during the same time. It's reasonable to say it had an exponential function up until two years ago, and we don't know what it was since then. R squared doesn't capture that inaccuracy because there is no data to compare it against during the scary time period in question. It's just a line in a void.
  - cutemonster 6y ago
    > cut off the line Or change to thin dashed line when no more data

menscher 6y ago

The trend-lines were really just to guide the eye (the text gives this context), but if you really must know: the R^2 for all three fits was above 0.9, suggesting the exponential growth model is reasonable. As you say, the pps and bps don't show much curvature, so a linear fit could indeed work for them for the displayed portion of the graph. But it's non-sensical when you look further back in time... predicting negative attack volumes prior to mid-2011. ;)

mlthoughts2018 6y ago
The criticism that it would go negative in the past is meaningless. Of course it’s unphysical, but that doesn’t mean a linear model isn’t appropriate for today’s data. You would just choose a point of time in the past where you believe the model is inapplicable. Maybe it was a different linear model then, or maybe mostly constant, who cares, we’re modeling today’s range of data, which might be well explained by a linear model, doesn’t really matter what 2011’s data was doing unless we separately believe the same growth law had to apply across all the years, and I see no reason why.
jackpirate 6y ago
Another alternative model besides linear would be quadratic (or another X^(1+epsilon) polynomial where epsilon is small). This would avoid the problem of negative data and likely fit the data better than an exponential.
- sdenton4 6y ago
  But why? I think the question is really about the growth of volume of connected, compromised devices. Growth curves are often sigmoid shaped, meaning, exponential until they're not. The exponential is often great for modeling growth trends up until the plateau, but it's hard to know when the corner will turn. Exponentials are also well motivated by differential equations... (Say, if you're modeling growth of IOT devices based on word of mouth.) Polynomials with degree 1+epsilon, less so.
  - cutemonster 6y ago
    Exactly. I wonder why some people seem to want other equations instead, how is that better
yjftsjthsd-h 6y ago
> The trend-lines were really just to guide the eye That's the problem, no? You can draw a line/curve over any data and convince a lot of people that it's relevant, but that's more cognitive bias than anything.

deleted 6y ago

[deleted]

howlgarnish 6y ago

Internet bandwidth growth is known to be exponential, so it would be odd if not dangerous to assume that DDoS volumes are not.

ekianjo 6y ago

That does not look like exponential growth at all.