The administrator has made the following configuration:
1. The signature set Protect_ all includes the signature ID3000, and the overall action of the signature set is to block.
2. The action of overwriting signature ID3000 is an alarm.

Which of the following options is correct for the sequence of the flow-by-stream detection of AntiDDoS?
1. The Netflow analysis device samples the current network flow;
2. Send a drainage command to the cleaning center;
3. Discover the DDoS attack stream;
4.Netior: analysis equipment sends alarms to ATIC management center
5. The abnormal flow is diverted to the cleaning center for further inspection and cleaning;
6. The cleaning center sends the host route of the attacked target IF address server to the router to achieve drainage
7. The cleaning log is sent to the management center to generate a report;
8. The cleaned traffic is sent to the original destination server.

When the Anti DDoS system finds the attack flow, the state will redirect the attack flow to the cleaning device.
After the cleaning device is cleaned, it will flow back.
Note to the original link, which of the following options does not belong to the method of re-injection?

Among the following options, which attack is a malformed packet attack based on the TCR protocol?

Which of the following options does not belong to the characteristics of big data technology?