How can we use metadata, inductive reasoning, and inference for things such as indicators of compromise (IOC), or potential attacks are underway and at the same time minimize false positives from the various attack vectors? For example, how could we infer through metadata that a Distributed Reflection Denial of Service (DRDoS) is more than likely underway?