Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy

Table 5

Characteristics of EDM-Fuzzy entropy curves of ARP traffic of botnet, DDoS, and normal status.

	Botnet	DDoS	Normal
Value	Mostly between 0.1 and 0.4.	Larger than 0.18 when the time scale is larger than 4.	Smaller than 0.18.
Trend	Entropy curves of all types of botnet traffic have an inflection point at a time scale of 30; 11 types have an inflection point at a time scale of 20.	Gradually stabilized to a value between 0.3 and 0.5 when the time scale is larger than 10.	Increase steadily from 0 to 0.18.