Fig. 4

Positive (left) and negative (right) predictive values as defined in (11) for APT detections using the model of “Markov chain models for DCNs” section and as functions of a per-window frequency threshold μ and for varying flow probability thresholds λ