Understanding the trend in scatter plot [DDoS vs Benign]

Hi everyone,

I am messing about with a DDoS dataset i found on Kaggle. I have two variables here, Fwd Header Len - the size of the header for Forward packets (source to destination). And TotLen Fwd Pkts - the total size of forward packets sent.

[https://imgur.com/a/XPmdZfw](https://imgur.com/a/XPmdZfw)

Does anybody know how to explain the positive correlation between the two variables in DDoS records and the reason why there is no linear correlation in benign records?

cybersecurity ddos trend vs