Skip to main content

Table 5 Entropy during normal web traffic with spoofed DDoS. During DDoS attacks, source address entropy and traffic entropy are observed at different times

From: Detection of spoofed and non-spoofed DDoS attacks and discriminating them from flash crowds

Time (seconds) Traffic entropy Source address entropy Proposed traffic entropy Proposed source
address entropy
0.6 3 3 2 2
3.6 5.2 6 4.3 5.2
6.6 5.2 7 4.3 6
9.6 5.2 8 4.3 7
12.6 5.2 8.36 4.3 7.11
15.6 5.2 8.36 4.3 7.11
18.6 5.2 8.36 4.3 7.11
21.6 4.18 8.36 3.22 7.11
24.6 4.18 8.36 3.22 7.11
27.6 4.18 9.51 3.22 8.45
30.6 4.18 9.51 3.22 8.45
33.6 4.18 9.51 3.22 8.45
36.6 4.18 9.51 3.22 8.45
39.6 5.2 9.51 4.3 8.45
42.6 5.2 8.36 4.3 7.11
45.6 5.2 8.36 4.3 7.11
48.6 5.2 8.36 4.3 7.11
51.6 5.2 8.36 4.3 7.11