Table 6 Variation in entropy during normal web traffic with non-spoofed DDoS attacks. The dynamics of source address and traffic entropies are recorded against different times
From: Detection of spoofed and non-spoofed DDoS attacks and discriminating them from flash crowds
Time (seconds) | Traffic entropy | Source address entropy | Proposed traffic entropy | Proposed source address entropy |
|---|---|---|---|---|
0.6 | 3 | 3 | 2 | 2 |
4.2 | 5.3 | 6 | 4.5 | 5 |
7.8 | 5.3 | 7 | 4.5 | 6 |
11.4 | 5.3 | 8 | 4.5 | 7 |
15 | 5.3 | 8.56 | 4.5 | 7.23 |
18.6 | 5.3 | 8.56 | 4.5 | 7.23 |
22.2 | 5.3 | 8.56 | 4.5 | 7.23 |
25.8 | 5.7 | 8.56 | 4.9 | 7.23 |
29.4 | 5.7 | 8.56 | 4.9 | 7.78 |
33 | 5.7 | 8.77 | 4.9 | 7.78 |
36.6 | 5.7 | 8.77 | 4.9 | 7.78 |
40.2 | 5.7 | 8.77 | 4.9 | 7.78 |
43.8 | 5.7 | 8.77 | 4.9 | 7.78 |
47.4 | 5.3 | 8.77 | 4.5 | 7.78 |
51 | 5.3 | 8.56 | 4.5 | 7.23 |
54.6 | 5.3 | 8.56 | 4.5 | 7.23 |
58.2 | 5.3 | 8.56 | 4.5 | 7.23 |
61.8 | 5.3 | 8.56 | 4.5 | 7.23 |