A Traffic Cluster Entropy Based Approach to Distinguish DDoS Attacks from Flash Event Using DETER Testbed

Figure 7

(a) Throughput of normal traffic. (b) Source address entropy of normal traffic. (c) Traffic cluster entropy of normal traffic.

(a)

(b)

(c)