Time signatures to detect multi-headed stealthy attack tools