An empirical evaluation of entropy-based traffic anomaly detection
Information-theoretic measures for anomaly detection