## 3 Proposed Approach  
This study's contribution adapts a dynamic threshold for the accurate detection of DDoS attacks with a low false positive rate. The value is adjusted in response to the dynamic network traffic flows since the attack traffic flow behaviors vary depending on the specified window size. However, the difference between the low and high DDoS attack traffic rates does little to improve the performance of detection techniques that depend on a static threshold. Adapting a dynamic threshold resulted in a lower false positive rate, a higher attack detection rate, and reduced time for selecting a threshold value since most attack detection techniques rely on observation and experimentation to find a fitting threshold value (static threshold). Furthermore, the dynamic threshold influences the technique's performance to detect low- and high-rate DDoS attacks. In addition, determining threshold values is usually time-consuming because it depends on observation and experimentation. So, the proposed method aims to dynamically find the threshold for detecting different DDoS attack traffic rates by autonomously observing the network traffic for attacks targeting single or multiple victims. The proposed approach's dynamic threshold value depends on three variables: (i) the number of incoming network traffic flows into the controller, (ii) the rate of DDoS attack traffic flows triggered toward the host victims, and (iii) the Renyi joint entropy value within a specific time interval (\(t\)). The Renyi joint entropy algorithm is a statistical method used to calculate packets' randomness in network traffic flows over a specific time interval. The proposed Renyi joint entropy algorithm is based on two variables from the packet header features, source IP and destination IP addresses, symbolized as \(x\) and \(y\). The Renyi joint entropy equation formula, Equation (1) [41], is based on generalizing Renyi joint entropy by merging two concepts: the joint entropy method and the Renyi method for analyzing the network traffic, which calculates the probability of each packet in the traffic flow within a specified time that depends on two packet header features to obtain the randomness of incoming traffic flows. Based on that, this work adopted the Renyi joint entropy equation method as an input to the dynamic threshold equation. \[H_{RJA}(x,y)=\frac{1}{1-\alpha}\log_{2}\left(\sum\limits_{i=1}^{N}\sum\limits _{j=1}^{M}p\left(x_{i}y_{j}\right)^{\alpha}\right) \tag{1}\]  
where \(H_{RJA}(x,y)\) indicates Renyi joint entropy and \(\alpha\) is a positive parameter and exposes the main mass (the concentration of events that occurred frequently). Thus, \(\alpha\) is an arbitrary value between 0 and 1 to provide a more accurate result and reduce the variance between observed values, which leads to more stability and convergence for the proposed approach [42]. Thus, the \(\alpha\) value is determined based on experimental observation and \(P\left(x_{i}y_{j}\right)\) represents the probability distribution between the source IP (\(x\)) and the destination IP (\(y\)) during the time \(t\). Furthermore, Equation (1) is used to calculate the randomness of these packets in the traffic flow (i.e., source/destination IP address) within a certain time \(t\). The attack behaviour and legitimate packet behaviour vary and this variation can cause fluctuations in the calculation of the threshold. The Renyi joint entropy algorithm, used in the calculation of the dynamic threshold, is found by the analysis of the incoming traffic flow statistics. Thus, we adopted the exponentially weighted moving average algorithm (EWMA) [40] in our proposed approach to generate a dynamic threshold method. The dynamic threshold depends on the Renyi joint entropy algorithm, which analyzes network traffic flow statistics collected by the SDN controller. Equation (2) is the basic EWMA equation.