## 6 Results and Discussion  
This section analyzes the impact of the entropy-based low-rate and high-rate DDoS attack detection approach regarding DR and FPR and discusses the experimental results obtained by implementing the DDoS attack detection approach in the following scenarios: (i) a single host with low-rate attack traffic against a single victim host (LSS), (ii) a single host with a high attack traffic rate against a single victim host (LSM), (iii) a single host with a high attack traffic rate against multiple victim hosts (LMS), (iv) a single host with a low attack traffic rate against multiple victim hosts (LMM), (v) multiple hosts with low attack traffic against a single victim host (HSS), (vi) multiple hosts with high attack traffic against a single victim host (HSM), (vii) multiple hosts with high attack traffic against a single victim host (HMS), and (viii) multiple hosts with high attack traffic against multiple victim hosts (HMM) [22].  
Figure 3 illustrates the average DRs and FPRs of the entropy-based detection technique for all low-rate DDoS attack scenarios.  
As observed in Figure 3, the fluctuation of DRs and FPR is because of the variations of the DDoS attack traffic rates in each scenario. The lowest FPR and highest DR are obtained when a low-rate DDoS attack is triggered by multiple host attacks that target a single victim. Meanwhile, the lowest DR and the highest FPR are obtained with a low-rate DDoS attack attack  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Attack Source**} & **Number of Low** & **Number of High** & **Number of Normal** \\  & **DDoS Attack Traffic** & **DDoS Attack Traffic** & **Packets (5 s/Packet** \\  & **(5 s/Packet per** & **(5 s/Packet per** & **per Legitimate Host)** \\  & **Attacker’s Host)** & **Attacker’s Host)** & **Pockets (5 s/Packet** \\ \hline Single Host’s Attack & 5 & 33 & 63 \\ \hline Multiple Hosts’ Attack & 15 & 166 & 61 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Distribution of packets’ numbers for various DDoS attack traffic rates with the normal traffic.  
attack triggered by a single host attack targeting multiple victims. The rationale behind the difference between the DRs and FPRs for low-rate DDoS attacks is a perceptible difference in the amount of attack traffic received by a single or multiple victims.  
In addition, the high-rate DDoS attack simulation scenario aims to check the entropy-based detection technique's ability to detect high-rate DDoS attack against the controller by a single or multiple hosts' attack that targets a single or multiple victim hosts in terms of DR and FPR. Furthermore, the detection technique depends on the entropy and threshold values to detect high-rate DDoS attack traffic. Figure 4 presents the average FPR and DR for all high-rate DDoS attack scenarios.  
As shown in Figure 4, DRs and FPR fluctuate due to the high DDoS attack traffic rate variation in each scenario. The lowest FPR and highest DR are obtained when a high-rate DDoS attack is triggered by multiple host attacks targeting a single victim. Meanwhile, the lowest DR and the highest FPR are obtained when the high-rate DDoS attack is triggered by a single host attack that targets multiple victims. The rationale behind the difference between the DRs and FPRs for high-rate DDoS attacks is a perceptible difference in the amount of attack traffic that a single or multiple victims receive.  
Figure 4: Average DRs and FPRs using high-rate attack scenarios in 30 min.  
Figure 3: Average DRs and FPRs using low-rate attack scenarios in 30 min.