"Flow Size Difference" Can Make a Difference: Detecting Malicious TCP Network Flows Based on Benford's Law.