Shui Yu et.al. [11] have observed that the zombies use controlled function(s) to pump attack packagesto the victim, therefore, the attack flows to the victim are always share some properties, e.g. packagesdistribution behaviors, which are not possessed by legitimate flows in a short time period. www.iosrjournals.org 51 | Page 3.