Table 5 Entropy during normal web traffic with spoofed DDoS. During DDoS attacks, source address entropy and traffic entropy are observed at different times
From: Detection of spoofed and non-spoofed DDoS attacks and discriminating them from flash crowds
Time (seconds) | Traffic entropy | Source address entropy | Proposed traffic entropy | Proposed source address entropy |
|---|---|---|---|---|
0.6 | 3 | 3 | 2 | 2 |
3.6 | 5.2 | 6 | 4.3 | 5.2 |
6.6 | 5.2 | 7 | 4.3 | 6 |
9.6 | 5.2 | 8 | 4.3 | 7 |
12.6 | 5.2 | 8.36 | 4.3 | 7.11 |
15.6 | 5.2 | 8.36 | 4.3 | 7.11 |
18.6 | 5.2 | 8.36 | 4.3 | 7.11 |
21.6 | 4.18 | 8.36 | 3.22 | 7.11 |
24.6 | 4.18 | 8.36 | 3.22 | 7.11 |
27.6 | 4.18 | 9.51 | 3.22 | 8.45 |
30.6 | 4.18 | 9.51 | 3.22 | 8.45 |
33.6 | 4.18 | 9.51 | 3.22 | 8.45 |
36.6 | 4.18 | 9.51 | 3.22 | 8.45 |
39.6 | 5.2 | 9.51 | 4.3 | 8.45 |
42.6 | 5.2 | 8.36 | 4.3 | 7.11 |
45.6 | 5.2 | 8.36 | 4.3 | 7.11 |
48.6 | 5.2 | 8.36 | 4.3 | 7.11 |
51.6 | 5.2 | 8.36 | 4.3 | 7.11 |