# Detection of DDoS Attacks in Software Defined Networking Using Entropy
## 5 Experimental Results and Discussion
According to the experimental results of log energy entropy, when an attack occurs, the attack can be detected immediately, but the change of entropy is small, and even a few extremely high entropy values will appear. Without changing other experimental conditions, fusion entropy is used to measure the randomness of the network. Table 4 shows the calculated fusion entropy values of  
Figure 5: Log energy entropy variation. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Log Energy Entropy** & \multicolumn{2}{c}{**Incoming Packets**} \\
**Normal** & **Attack** & **1** \\ \hline
2.66956 & 2.67964 & 1 \\
3.05772 & 1.23388 & 10 \\
2.97717 & 1.0398 & 20 \\
3.05772 & 1.0398 & 30 \\
2.97717 & 1.04654 & 40 \\
3.05772 & 1.04654 & 50 \\
2.97717 & 1.09536 & 60 \\
3.05772 & 1.0398 & 70 \\
2.97717 & 2.96453 & 80 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Log Energy Entropy values. partial data packets in the normal and attack scenario. The entropy values of the data packets with 10 nodes in the above representative data packets are selected. Figure 6 shows the comparison of fusion entropy under the two scenarios. In normal traffic scenarios, the entropy value of packets ranges from 2 to 3.3. We use the minimum entropy value of 2 as the threshold to ensure a small error. It can be seen from the figure that in the attack scenario, the value of fusion entropy starts to decline from the third packet, showing an earlier change. The lowest point of entropy of normal flow is 2.01975. The maximum entropy of attack traffic is 0.17669 when very few abnormal data are discarded. The difference between the two is 1.84306, indicating that the fusion entropy decreases by 91.25% when the attack occurs. The experimental results of fusion entropy show that when an attack occurs, the fusion entropy can quickly detect the attack, inheriting the advantages of log energy entropy, while the entropy value decreases significantly, inheriting the advantages of information entropy, and making good use of the complementarity of the two entropies to effectively detect the attack. Figure 7 lists the comparison between different entropy calculation methods. It can be seen from the figure that the fusion entropy represented by solid line is obviously better than the other two kinds of entropy represented by dotted line and has good effects in rapid detection and entropy value decrease, thus achieving the purpose of attack detection. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Fusion Entropy** & \multicolumn{2}{c}{**Incoming Packets**} \\
**Normal** & **Attack** & **Incoming Packets** \\ \hline
3.03872 & 2.93872 & 1 \\
2.18832 & 0.13869 & 10 \\
2.25056 & 0.13869 & 20 \\
2.08832 & 0.1411 & 30 \\
2.25056 & 0.13869 & 40 \\
2.18832 & 0.14284 & 50 \\
2.25056 & 0.16812 & 60 \\
2.28832 & 0.14284 & 70 \\
2.25056 & 2.35056 & 80 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Fusion entropy values. Figure 6: Fusion entropy variation. Table 5 lists the comparison between the proposed method and other attack detection methods. The results show that the fusion entropy detection method used in this paper can achieve a higher entropy decline rate and has the function of rapid detection. The above experimental results show that the fusion entropy has a good attack detection performance and can effectively make use of the complementarity of information entropy and log energy entropy. It not only has a fast attack detection speed, but also has a high entropy decline rate, which is significantly improved compared with other methods, which indicates the method can well detect DDoS attacks in simulated network scenarios.