## 2 Related Work
In [10], the authors propose an efficient behavioural-based anomaly detection technique by comparing the maximum entropy of network traffic against a baseline distribution, using a sliding window technique with fixed time slots. The method is applied generically across TCP and UDP traffic and is limited to only three features (based on protocol information and the destination port number). They are able to detect fast or slow deviations in entropy; for example, an increase in entropy during an SYN Flood. In [14], the authors analyse entropy changes over time in PTR RR (Resource Records (RR) used to link IP addresses with domain names) DNS traffic to detect spam bot activity. In [15], the authors build on the concepts outlined in [16], capturing network packets and applying relative entropy with an adaptive filter to dynamically assess whether a change in traffic entropy is normal or contains an anomaly. Here, the authors employ several features, including source and destination IP address, source and destination port, and the number of bytes and packets sent and received. In [17], the authors describe an entropy-based encrypted traffic classifier based on [PERSON]'s entropy, weighted entropy [18], and the use of a Support Vector Machine (SVM). Figure 4: Two phase analysis for calculating service baseline metrics for payload entropy. Packets are first grouped into logical flows to ensure that we are tracking entropy changes for each discrete flow duration. All flow entropy values are then grouped by service types, and overall baseline entropy metrics are calculated. Note that the contribution of each dataset is weighted by sample size (to avoid the case where a smaller anomalous dataset distorts the overall metrics).We also ignore samples that are clearly labelled as anomalous in datasets such as those used in intrusion detection, since these samples may include values outside the expected baseline range. In [19], the authors propose a taxonomy for network covert channels based on entropy and channel properties, and suggest prevention techniques. More recently, in [20], the authors focus on the detection of Covert Storage Channels (CSCs) in TCP/IP traffic based on the relative entropy of the TCP flags (i.e., deviation in entropy from baseline flag behaviour). In [21], the authors describe entropy-based methods to predict the use of covert DNS tunnels, focussing on the detection of embedded protocols such as FTP and HTTP. Cyber physical systems present a broad attack surface for adversaries [22], and there can be many active communication streams at any point in time. These channels can be blended into the victim's environment and used for reconnaissance activities and data exfiltration. In [23], the authors use TCP payload entropy to detect real-time covert channels attacks on Cyber-Physical Systems (CPSs). In [24], the authors describe a flow analysis tool that provides application classification and intrusion detection based on payload features that characterise network flows, including deriving probability distributions of packet payloads generated by N-gram analysis [25]. Computing entropy in packet flows can be implemented by maintaining counters to keep track of the symbol distributions. However, this requires the flow state to be maintained over time (we describe this further in Section 3). This can be both computationally and memory intensive--particularly in large network backbones with many active endpoints, since flows may need to reside in memory for several minutes, possibly longer. For example, in [16], the authors state that their method requires constant memory and a computation time proportional to the traffic rate. Where entropy is to be calculated in real time, a different approach is required. In [26], the authors offer a distributed approach to efficiently calculate conditional entropy to assist in detecting anomalies in wireless network streams by taking packet traces while an active threat is in progress.