Shannon Entropy Based DDoS Attack Detection Using Adaptive Threshold

Abstract

Distributed Denial of Service (DDoS) attacks pose a significant threat to high-speed networks. This paper proposes a lightweight entropy-based DDoS detection method using Shannon entropy combined with adaptive statistical thresholding. The approach calculates entropy values of network traffic and dynamically determines thresholds based on mean and standard deviation to classify traffic into normal, suspicious, and attack states. The proposed method is evaluated using benchmark datasets such as DARPA and Midterm 53 group network traffic dataset. Performance is measured using detection rate, false positive rate, and accuracy. Experimental results show that the proposed method achieves high detection accuracy with low computational overhead, making it suitable for real-time deployment. The method outperforms traditional static threshold-based approaches in terms of adaptability and robustness.