Research Article
[Retracted] DDoS Detection Using a Cloud-Edge Collaboration Method Based on Entropy-Measuring SOM and KD-Tree in SDN
Algorithm 1
DDoS detection based on EMSOM-KD.
| Input: the detected flow vector, SOM map, abnormal neuron set , normal neuron set , suspicious neuron set , KD-tree. | | Output: the detection result. | (1) | For each network flow | (2) | Normalize the detected flow vector by (1). | (3) | Compute the best match neuron in the suitable SOM map. | (4) | If the best match neuron is in , then | | The detected flow is normal. | | Else if the best match neuron is in , then | | The detected flow is abnormal. | | Else | | The detected flow is suspicious. | | End if | (5) | End for | (4) | For each suspicious flow | | Search the nearest nodes in the KD-tree. | | Count the number of nodes of each type. | | If the number of normal nodes is more than , then | | The detected flow is normal. | | Else | | The detected flow is abnormal. | | End for |
|