## 7 Comparative Analysis  
This section compares the performance of the entropy-based detection approach by comparing the results of low-rate DDoS attack scenarios with high-rate DDoS attack rate scenarios in terms of DRs and FPRs by executing single-host and multiple-host attack scenarios that target a single or multiple victims. The evaluation metrics used in the benchmarking are DRs and FPR [22]. Those metrics are widely employed to assess an IDS that detects DDoS attacks in SDN and traditional networks. Figures 5 and 6 show the average DRs and FPRs of high and low DDoS attack traffic rates for all scenarios.  
Figures 5 and 6 present the performance of the entropy-based detection approach in discerning low-rate and high-rate DDoS attacks. The detection approach clearly outperformed others in detecting high-rate DDoS attacks of the average DR and the average FPR in all simulation scenarios because the detection approach can collect more statistics on new incoming network traffic since it has a high traffic rate, which increases the amount of statistical information about the incoming traffic flows. At the same time, the detection approach is affected by a low DR and a high FPR in detecting low-rate DDoS attack traffic against controllers that target multiple victims.  
Figure 5: Comparison of the average DR of low-rate and high-rate attacks in using simulation scenarios.  
Figure 6: Comparison of the FPR of low-rate attack and high-rate attack in using simulation scenarios.  
The number of attack sources that increase or decrease their attack traffic rates (spoofing source IPs) determines the DDoS attack rates on a network. The DDoS attack could be triggered by a single host's attack (single attacker) or multiple hosts' attacks (multiple attackers), affecting the attack DR and FPR. Based on that, the entropy-based detection approach proved its ability to detect high-rate DDoS attack that targets a single or multiple victims with a high DR and a low FPR by depending on incoming network traffic statistics, which can change its values per the network traffic flows within a period \(t\) (window size).  
Figure 7 shows the entropy-based detection approach's enhancement for detecting low-rate and high-rate DDoS attacks focusing on a single or multiple victims using the DR and FPR metrics. By comparing high and low DDoS attack traffic rates, detection results in the following: a low attack rate with a high attack rate triggered by a single host's attack that targets a single victim (L/HSS), a low attack rate with a high attack rate triggered by a single host's attack that focuses on multiple victims (L/HSM), a low attack rate with a high attack rate triggered by multiple hosts' attacks that target a single victim (L/HMS), and a low attack rate with a high attack rate triggered by multiple hosts' attacks that target multiple victims (L/HMS).  
Figure 7 demonstrates that the entropy-based detection approach enhances the average DDoS attack DRs for detecting a high DDoS attack traffic rate compared with a low DDoS attack traffic rate by 6.25%, 20.26%, 6.74%, and 8.81%. In addition, the entropy-based detection approach reduces the average FPRs for detecting a high DDoS attack traffic rate compared with a low DDoS attack traffic rate by 67.68%, 77.54%, 66.94%, and 64.81 for L/HSS, L/HSM, L/HMS, and L/HMM, respectively.