Adaptive DDoS Attack Detection: Entropy-Based Model With Dynamic Threshold and Suspicious IP Reevaluation - Juri Pebrianto; Vera Suryani (IEEE Access)
DDoS constitutes a significant andger to network security, frequently employing anomalous traffic patterns to impede services. DDoS detection can be executed by an entropy-based anomaly detection approach, which juxtaposes the entropy value with the threshold $δ $ . Nonetheless, prior research indicates that the threshold $δ $ with a static k as the threshold sensitivity parameter is inadequate for detecting attacks on dynamic traffic patterns. This study presents two significant innovations: the re-evaluation of suspect IPs and the dynamic adjustment of the threshold via the parameter $k_{\text {dynamic}}$ . Reevaluation is utilised to address dubious IPs that evade initial identification due to erratic traffic patterns, whereas $k_{\text {dynamic}}$ is engineered to enhance detection sensitivity by automatic adaptability to traffic fluctuations. The experimental results indicate that the method incorporating re-evaluation of suspect IPs enhances detection accuracy. Concurrently, the method utilising $k_{\text {dynamic}}$ demonstrates enhanced detection efficacy while minimising the necessity for human modification of the k parameter. The suggested method, through these advances, surmounts the limits of prior systems, facilitating more efficient and adaptive detection of complicated attack traffic patterns.