A Traffic Cluster Entropy Based Approach to Distinguish DDoS Attacks from Flash Event Using DETER Testbed

<table class="table-group" id="tab5"><tr><td><table class="table"><tr><td class="thead-hr" colspan="4"><hr/></td></tr><tr class="thead"><td align="left"> </td><td align="center">Source address entropy range</td><td align="center">Traffic cluster entropy range</td><td align="center">Traffic received by server</td></tr><tr><td class="thead-hr" colspan="4"><hr/></td></tr><tr><td align="left">Normal traffic </td><td align="center">3.815607–4.125917</td><td align="center">2.728398–2.772241</td><td align="center">210 kbps–260 kbps</td></tr><tr><td align="left">Normal traffic with UDP and TCP attacks</td><td align="center">3.815607–6.378821</td><td align="center">2.714725–5.526648</td><td align="center">400 kbps–440 kbps</td></tr><tr><td align="left">Flash traffic</td><td align="center">5.290918–5.721889</td><td align="center">2.701708–2.776293</td><td align="center">375 kbps–450 kbps</td></tr><tr class="table-tr"><td colspan="4"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

Comparative analysis of source and traffic cluster entropy for normal, flash, and attack traffic.

International Scholarly Research Notices

tab5

Table 5

Table 5: A Traffic Cluster Entropy Based Approach to Distinguish DDoS Attacks from Flash Event Using DETER Testbed 