After analyzing, the similar features will be grouped into each layer which quantifies the normal service behavior precisely according to their characteristics.