DDoS Detection with Information Theory Metrics and Netflows - A Real Case
Information-Theoretic Measures for Anomaly Detection
Flexible Deterministic Packet Marking: An IP Traceback System to Find the Real Source of Attacks
An empirical evaluation of entropy-based traffic anomaly detection
Testing Intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory
A mathematical theory of communication: Meaning, information, and topology