## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.1 Entropy-Based Detection Method
In this method, the cluster entropy is contrasted against a threshold, and, if  
Figure 9: Generic framework of a conventional entropy-based DDoS attack detection approach adapted from [63]. it is above the threshold, then packet scoring methods are used to discard the blacklisted packets, where the score of each packet \(P_{sc}\), is estimated using (12) [64]:  
\[P_{sc}=\frac{P_{t_{i}}}{P_{T}} \tag{12}\]  
where the following holds:  
\[P_{T}=\sum_{i=1}^{n}P_{t_{i}} \tag{13}\]  
In (13), \(P_{ti}\) is the incoming traffic packets at time slot \(t\), \(P_{T}\) is the aggregated number of packets, and \(n\) is the number of packets arriving during the time slot. The approach was implemented using OMNET++ and achieved high precision, which means that attack traffic is accurately detected. [PERSON] et al. [61] implemented an entropy-based approach proposed by [65] for the detection of attacks using flow-based features. Anomalies are detected using pre-established thresholds based on variations in the entropy levels. For portscan, DDoS, and worm attacks, evaluation results demonstrate that good detection accuracy is attained despite having 23%, 27%, and 34% false positive rates, respectively. A three-module detection system using joint entropy metrics was also suggested by the authors in [66]. The detection system has a module for handling incoming traffic, after which the entropy calculator module evaluates the entropy of the packet features. The detection module, which evaluates the estimated entropy against a threshold, makes up the third component. If the estimated entropy exceeds the threshold, an attack alarm is raised, as considered in [61; 62; 63; 64; 65]. The method was successfully tested on the DARPA'99, 2009, and current CICDDoS2019 datasets. The use of a static threshold limits its applicability to real-world packets with fluctuating traffic. The threshold chosen has a significant impact on how well the entropy-based approaches function. It has been noted that the effectiveness of any entropy-based solution for DDoS attack detection depends greatly on the threshold value chosen. A static threshold might not always produce the correct results. The threshold value must be updated according to the incoming packet traffic conditions. Thus, [PERSON] and [PERSON] [67] proposed an adaptive threshold algorithm and fast entropy computation method for flooding attack detection using the flow count feature. In this method, fast entropy is computed during each time slot using (14) [67]:  
\[\widehat{H}(i,t)=-\log\biggl{(}\frac{x(i,t)}{\sum_{i=1}^{n}x(i,t)}\biggr{)}+ \tau(i,t) \tag{14}\]  
where the following definition is necessary:  
\[\tau(i,t)=\left\{ \begin{array}{l}\left|\log\left(\frac{x(i,t+1)}{x(i,t)} \right)\right|,\qquad x(i,t)\geq x(i,t+1)\\ \left|\log\left(\frac{x(i,t)}{x(i,t+1)}\right)\right|,\qquad x(i,t)<x(i,t+1) \end{array} \right. \tag{15}\]  
Additionally, mean \(\mu_{t}\) and standard deviation \(\delta\) of the flow count during time slot \(t\) are computed, and a difference between the mean and the fast entropy is estimated using (16) [67]:  
\[D(i,t)=\left|\mu_{t}-\widehat{H}(i,t)\right| \tag{16}\]  
The adaptive threshold algorithm then raises an alarm by checking the difference \(D(i,t)\), as shown in (16). If \(D(i,t)>\beta\delta\), it is assumed that attack traffic will occur, and a DDoS attack alarm will be raised; otherwise, normal traffic will occur, and the value of is updated. The adaptive threshold \(\beta\) value takes the following form [67]:  
\[\beta=\left\{ \begin{array}{l l}\beta-1&if\qquad\widehat{H}(i,t)<0.5\mu_{t} \\ \beta&if\quad 0.5\mu_{t}\leq\widehat{H}(i,t)<1.5\mu_{t}\\ \beta+1&if\qquad\widehat{H}(i,t)>1.5\mu_{t}\end{array} \right. \tag{17}\]The results obtained demonstrate that using a threshold that is adaptively adjusted based on the conditions of the traffic pattern increases detection accuracy. However, the processing time increases.