## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.1 Entropy-Based Detection Method  
Conventionally, entropy assesses the degree of information uncertainty and has been successfully used to calculate the randomness of datasets [61]. Low entropy levels represent the concentration of a distribution, whereas high entropy levels represent a more dispersed probability distribution. Entropy has been suggested as a useful tool for analysing traffic distributions in a number of recent studies [61, 62, 63, 64]. These studies have described its application to detect attacks in IoT and SDN networks. This method calculates the entropy by analysing the distribution of features in traffic packets, like source IP, destination IP, flow count, and port numbers. The presence of anomalies in these features is then localized by comparing the entropy values against a predetermined threshold. A sudden shift in entropy levels is typically a potential sign that a DDoS attack may have taken place. Entropy dramatically decreases in the presence of an attack because one flow count dominates. It was discovered in the research studies conducted by [PERSON] and [PERSON] [65] that the degree to which the entropy changes during these attacks depends on the observed packet  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Methods** & **Features** & **Advantages** & **Limitations** \\ \hline Traffic pattern analysis [49, 50, 51, 52, 53, 54] & Compares the traffic patterns of infected hosts to the benign hosts & •  
header field. While the entropy of the source IP increases due to an attack, the entropy of the destination IP decreases. Entropy will be constant in the absence of an attack. A typical framework for an entropy-based approach to detecting DDoS attacks is shown in Figure 9.  
In Figure 9, for each packet of traffic at time slot \(t\), the IP addresses of each packet are extracted and batched in accordance with the source IP addresses. If \(X\) represents a random variable that denotes the extracted IP, then the probability of occurrence of each batch \(P(x_{i})\) and the overall entropy \(H(X)\) are estimated as follows:  
\[P(x_{i})=\frac{x}{\sum\limits_{i=0}^{n}x_{i}} \tag{7}\]  
\[H(X)=-\sum\limits_{i=1}^{n}P(x_{i})\log(P(x_{i})),\quad x_{i}\in X \tag{8}\]  
Entropy is computed using [PERSON]'s entropy theory and compared to a pre-defined threshold \(T\). An attack alarm is then raised if \(H(X)\) is greater than \(T\), as illustrated in (9):  
\[H(X)\bigg{\{} \begin{array}{l}>T\Rightarrow\quad Attack\quad traffic\\ \leq T\Rightarrow\quad Normal\quad traffic\end{array}  \tag{9}\]  
[PERSON] et al. [63] included a packet discarding process in the traditional entropy-based framework in Figure 9. When a DDoS warning occurs during this process, all the packets with the highest \(P(x_{i})\) are blacklisted and are subsequently regarded as malicious packets in the following time frame. These packets are discarded if the newly arriving IP address is on the blacklist. Otherwise, a new group of IP addresses is created, and the entropy value is calculated and compared to the threshold. The batch with the highest likelihood of occurrence is identified, and all the IP addresses in this batch are blacklisted once the entropy is above the threshold. Advancing the studies in [63], the authors in [64] utilized clustering and packet scoring methods to detect and discard malicious requests. In this approach, the change during a DDoS attack is represented by a monotonically increasing convex function following [PERSON]'s inequality using (10) [64]:  
\[H[f(x)]\geq f(H[x]) \tag{10}\]  
In (10), \(H[x]\) is the anticipated value of the convex function. Therefore, it is expected that the cluster entropy of legitimate traffic will be lower than that of a DDoS attack. Thus, the following inequality arises:  
\[H(X_{NT})<H(X_{AT}) \tag{11}\]  
In (11), \(H(X_{NT})\) is the cluster entropy during normal traffic, whereas \(H(X_{AT})\) is that due to attack traffic.