Information theory-based DDoS Defence solutions in SDN

Information theory-based entropy and divergence metrics are widely used for DDoS attack detection. Entropy represents the randomness in the network features, whereas a divergence metric represents the similarity of two probability distributions. The concept of uncertainty’s measurement is coined initially by Claude Shannon in 1948. The information distance or divergence metric calculated using different probability distributions of traffic flows used to find the abnormality of network traffic. By using the entropy measure, it can be seen how the current network behaviour deviates from normal network behaviour, which leads to the detection of a DDoS attack. This is a comparison between the DDoS defence approaches using entropy and divergence metrics.