On the Impact of Entropy-based Features Iuri Mundstock∗ , Abreu Quevedo∗ , Jéferson Campos Nobre§ , Roben C. Lunardi† , Thiago L. T. da Silveira‡ , Bruno L. Dalmazo∗ † IFRS and PUCRS, Porto Alegre, Brazil
E-mail: [email protected]
§ Federal University of Rio Grande do Sul - UFRGS, Porto Alegre, Brazil
E-mail: [email protected]
‡ Federal University of Santa Maria - UFSM, Santa Maria, Brazil
E-mail: [email protected]
∗ Federal University of Rio Grande - FURG, Rio Grande, Brazil
M AC AN C E US P T CR E D IP T
arXiv:2607.15379v1 [cs.CR] 16 Jul 2026
E-mail: {iurimundstock, abreu_rg, dalmazo}@furg.br
Abstract—Network anomaly detection is increasingly challenging due to the growing diversity and variability of traffic patterns, which are not always well captured by traditional statistical features. In this work, we explore the use of entropy as an additional feature to support supervised network traffic classification. The main idea is to use entropy to represent variability in selected traffic attributes, complementing conventional descriptors rather than replacing them. We integrate the entropy-based feature into a standard machine learning pipeline and evaluate its impact through a direct comparison between models trained with and without this feature. Experiments conducted on a public intrusion detection dataset show consistent improvements in classification performance, while the additional computational cost remains low. The analysis of confusion matrices indicates a reduction in misclassifications, especially in traffic scenarios with higher variability. Overall, the results suggest that entropy-based features offer a simple and practical way to enhance existing anomaly detection pipelines. This approach is particularly attractive in settings where lightweight feature engineering and interpretability are important, making entropy a useful complement to commonly used traffic features. Index Terms—Anomaly Detection, Computer Networks, Entropy
I. Introduction
The rapid evolution of distributed and cognitive cloud infrastructures, combined with the digitalization of urban environments, has led to the emergence of complex systems such as smart cities. These environments generate large volumes of high-dimensional and dynamic data, making efficient data representation and analysis a critical challenge. At the same time, the growing dependence on Internet-based services reinforces the importance of ensuring the security and reliability of network systems. According to the International Telecommunication Union, 5.5 billion people accessed the Internet in 2024, representing 68% of the world’s population [1], [2]. Among the main threats to these systems are denialof-service (DoS) and distributed denial-of-service (DDoS) This manuscript has been accepted for presentation at the IEEE International Symposium on Computers and Communications (ISCC 2026).
attacks, which can disrupt services and cause significant financial and operational damage. Therefore, the development of effective traffic analysis and anomaly detection mechanisms is essential to ensure system resilience [3]. In addition to detection accuracy, a key challenge lies in efficiently representing network traffic data, as traditional approaches often rely on high-dimensional feature sets or handcrafted statistical descriptors that may fail to capture behavioral patterns. Entropy-based representations have been widely used in network traffic analysis as an effective way to capture variability and uncertainty [4], [5]. However, most existing approaches are limited to static or coarse-grained formulations, typically applied to individual features or aggregated statistics. To overcome these limitations, this work proposes a temporal and multidimensional entropy modeling approach, capable of capturing both structural dependencies between traffic attributes and their evolution over time. In the literature, several studies address DoS and DDoS detection using machine learning techniques [6], [7]. However, many of these works rely on predefined feature sets and do not explore more expressive representations of traffic behavior. In this context, the proposed method advances the state of the art by introducing entropybased features that improve anomaly detection performance while providing a more compact representation of high-dimensional data, particularly suitable for dynamic environments such as smart cities. In this context, this work aims to develop a feature for network traffic classification based on entropy calculation. The main contributions of this work are: (i) an empirical analysis of entropy-based features for network traffic anomaly detection; (ii) an evaluation of their impact when combined with standard supervised classifiers; (iii) a discussion of their applicability in resource-constrained detection pipelines. The remainder of this paper is organized as follows: Section II presents a review of the current literature and discusses existing research gaps. Section III describes the
step-by-step execution of the proposed approach, including the entropy calculation method and the process for generating a new feature. The analysis and discussion of the results are presented in Section IV. Finally, Section V concludes the paper and outlines directions for future research. II. Related work
Dataset CIC-IDS17
[9]
CIC-DDoS19
[10]
MTS-IoT
[11]
CIC-IDS17
[12]
CAIDA
[13]
CIC-IDS17, CIC-DDoS19
[14]
Own
Main Contribution RF-based DDoS detection using entropy features. Entropy-based information gain for feature ranking. Supervised entropy-driven DDoS detection framework. Neural network enhanced with entropy features. Packet size entropy for binary traffic classification. Deep learning with entropy features and noise regularization. Distributed detection using entropy, ML, and fuzzy logic. K-means and KNN with entropy-based features. Survey of entropy-based DDoS detection methods. Entropy-based feature selection with RF classifier. SVM combined with entropy features. Feature selection for entropy-based detection. RF using entropy measures and Gini coefficient. CNN-based detection using relative entropy. RF-based detection using Gini impurity. FlowGuard: entropy-based IoT DDoS filtering. Entropy-driven traffic patterns via HTM. Anomaly detection combining entropy and ML.
M AC AN C E US P T CR E D IP T
This section presents the systematic methodology used to retrieve existing studies in the context of distributed denial-of-service (DDoS) attack detection in computer networks using entropy and machine learning techniques. In this section, the research method adopted is described, as well as the articles identified through this methodology.
TABLE III: Related Works Using Entropy Ref. [8]
A. Selection Method
[15]
NSL-KDD
In the context of distributed denial-of-service (DDoS) attack detection, the keywords used for the literature search were “DDoS attack detection,” “Distributed Denial of Service attack detection,” “entropy,” and “machine learning.” Thus, the combination of keywords shown below was used to perform the query on the platform, and the criteria described in Table I were applied, resulting in the set of studies presented in Table II.
[16]
–
[7]
LLDoS1.0, 2.0.1
[17]
NSL-KDD
[18]
BoT-IoT
[6]
Own
[19]
Own
[20]
Own
[21]
CIC-DDoS19
[4]
CIC-DDoS19, MAWI CSE-CIC18, CIC-DDoS19
(“DDoS attack detection” OR “Distributed Denial of Service attack detection”) AND (“entropy” AND “machine learning”)
TABLE I: Inclusion (IC) and Exclusion (EC) Criteria Inclusion Criteria IC1 Exclusion Criteria EC1 EC2
[22]
Publication period between 2018 and 2025 No feature selection performed Does not use entropy
TABLE II: Selected Studies Results IEEE Xplore Not included by IC1 Excluded by EC1 Excluded by EC2 Selected Articles
Total 48 02 21 05 20
B. Discussion
As shown in Table III, many studies make use of datasets provided by the Canadian Institute for Cybersecurity, such as CIC-IDS2017 and CIC-DDoS2019, available in [23]. However, there are differences between these datasets, as each one contains distinct distributions of attack types. The dataset selected for this research is CIC-IDS2017, which has been used in studies such as [13], [11], and [8] for the evaluation of the proposed methods. Several studies focus on selecting the most relevant features for detecting denial-of-service attacks using different selection methods. Among them, entropy stands out because it has shown promising results, which is why it
is also adopted in this work. In addition, many machine learning techniques have been applied to this problem, with Random Forest being one of the most frequently cited models. As an ensemble of decision trees, it has consistently demonstrated strong performance in attack detection. Finally, a review of the literature reveals that although many studies focus on detecting and mitigating distributed denial-of-service attacks using entropy, none of them primarily emphasize the generation of rules for blocking malicious traffic. Therefore, this work employs a Random Forest model (widely recognized in the literature as an effective method for real-time traffic classification) with the objective of generating rules that enable the blocking of malicious traffic. III. Proposal This section presents the proposal of the work and describes, step by step, how its implementation is carried out. The objective of this work is to develop a feature based on entropy for anomaly detection and to validate it using a Random Forest model, classifying network traffic as legitimate or malicious.
The underlying hypothesis of the proposed feature is that anomalous traffic exhibits higher structural unpredictability in selected packet attributes when compared to benign traffic. Such unpredictability is not necessarily reflected in first-order statistics, motivating the use of entropy as a complementary descriptor. A. Conceptual model
M AC AN C E US P T CR E D IP T
In the first step, as shown in Fig. 1, a preprocessing procedure and a time series analysis were applied to the dataset with the objective of understanding and transforming the data to facilitate its use in the subsequent steps. This stage is essential to ensure that the data are properly treated and ready to be efficiently used in later analyses. The dataset is divided into training (70%) and testing (30%) sets. Entropy is computed independently for each subset to avoid data leakage. A Random Forest model is then trained using the enriched feature set and evaluated on the test data.
feature scales, and effectiveness in modeling non-linear decision boundaries without extensive hyperparameter tuning. This makes it a suitable baseline for evaluating the impact of feature engineering strategies, particularly the inclusion of entropy-based features. However, it is important to note that Random Forest presents limitations in terms of scalability and sensitivity to class imbalance in real-time network environments. Despite these constraints, it provides a reliable and widely adopted reference model for assessing whether entropyderived features contribute complementary discriminative information. Subsequently, a traffic simulation is carried out using the second portion of the dataset, representing thirty percent of the original data, to perform classification using the Random Forest model trained in the previous step. Based on the results of this classification, rules are generated to block malicious traffic. Finally, the results are presented in detail, including analyses, interpretations, and graphical representations of the outcomes, as well as the application of the Random Forest classifier and the evaluation of anomaly detection. The strengths and limitations of the proposed method are discussed, along with insights and recommendations for future research in this area. This stage aims to provide a comprehensive and well-founded overview of the study’s results, contributing to the advancement of knowledge in anomaly detection in computer networks.
Fig. 1: Conceptual model
Unlike approaches that rely on complex representations or deep feature learning, this work explores entropy as a lightweight statistical proxy for capturing dispersion patterns in network traffic attributes. The underlying hypothesis is that anomalous traffic often exhibits irregular or highly concentrated distributions over selected feature dimensions, which can be effectively summarized through entropy-based measures. Then, with the dataset properly divided, the entropy is calculated individually for each part. This calculation is used to enable the Random Forest model to better understand network behavior patterns, aiming to improve its performance. After that, the Random Forest model is trained for traffic classification. Random Forest was selected due to its robustness to noise, ability to handle heterogeneous
B. Dataset This work uses the CIC-IDS2017 dataset, which contains network traffic records collected over five consecutive days, including both benign behavior and a diverse set of attack scenarios. The complete dataset is considered in order to provide a comprehensive evaluation and improve the generalizability of the results. It is available in CSV format, with a total size of 1725.05 MB and 2,830,743 input instances. The dataset includes multiple types of attacks distributed across different days, such as brute force (FTP and SSH), several DoS variants (e.g., Hulk, Slowloris, GoldenEye), web-based attacks (e.g., XSS and SQL injection), infiltration, and botnet activity. These scenarios occur at different time intervals and under varying traffic conditions, enabling the evaluation of the proposed method in heterogeneous and dynamic environments. It is also worth noting that the first day (Monday, 07/03/2017) contains only benign traffic and is included to represent normal network behavior. IV. Evaluation and Results This section presents the results obtained in this research, including the graphical representation of the experiments and a detailed discussion of the findings. The performance of each model is analyzed based on the adopted evaluation metrics, allowing a fair comparison between the proposed approaches. To ensure statistical
robustness and reduce variability due to data partitioning, all experiments were conducted using 15-fold stratified cross-validation, and the reported results correspond to the mean performance across the folds. All classifiers were evaluated using the default decision threshold provided by the learning algorithm, and no threshold tuning or classdependent calibration was performed in any approach. A. Entropy calculation
B. Random Forest and classification Two versions of the dataset were considered: one composed of the original features after the application of the preprocessing stage, and another enriched with the entropy values calculated based on the formulation presented earlier. From these two configurations, the classification stage was carried out, enabling a comparative analysis of the impact of the entropy-based feature on the model’s performance. Thus, for the implementation, the Python programming language was adopted due to its wide use in machine learning applications. The Pandas library was employed for dataset loading and manipulation, Matplotlib for result visualization, NumPy for numerical operations, and Scikitlearn (sklearn) for data preprocessing and the application of machine learning algorithms, including the Random Forest model used in this work, which facilitated the implementation and the presentation of the results.
M AC AN C E US P T CR E D IP T
In this work, entropy is not computed as a static descriptor over individual features, but rather as a dynamic and multidimensional representation of network traffic behavior. Given a discrete random variable X, the entropy is defined:
These extensions allow the proposed method to capture both the structural dependencies between traffic attributes and their temporal evolution, providing a more expressive representation of anomalous behavior when compared to traditional entropy-based features.
x∈X y∈Y
where p(x, y) represents the joint probability of observing the pair (x, y), enabling the capture of structural relationships between traffic attributes. Furthermore, to model the temporal dynamics of network traffic, entropy is computed over sliding windows of size w. For each time step t, the entropy Ht is calculated based on the subset of observations within the interval [t−w, t]. From this temporal sequence, additional features are derived, including: • Entropy variation: ∆Ht = Ht − Ht−1
•
Local mean entropy:
t 1 X µt = Hi w i=t−w
•
Entropy volatility:
v u t u1 X σt = t (Hi − µt )2 w i=t−w
C. Analysis of Results
In this section, the results obtained from the conducted experiments are presented, with the objective of evaluating the impact of the entropy-based feature on the performance of the network traffic classification model. We acknowledge that the use of a single dataset may limit the generalization of the reported results. The goal of this evaluation is not to claim universal applicability, but to assess whether entropy-based features provide consistent gains within a controlled and widely used benchmark. Initially, two confusion matrices are presented for comparison of the classification performance: the first, illustrated in Figure 2, corresponds to the baseline scenario without the introduction of the entropy-based feature, while the second, shown in Figure 3, refers to the scenario with the inclusion of the proposed feature.
0
where: • H(X): represents the entropy of the variable X, measuring the uncertainty or unpredictability associated with its outcomes; • p(xi ): denotes the probability of occurrence of the event xi ; • logb : is the logarithm with base b, where b = 2 is used to express entropy in bits. Unlike conventional approaches, which compute entropy over single attributes, this work employs a multidimensional formulation based on the joint distribution of multiple traffic features. In this case, the entropy is computed as: XX H(X, Y ) = − p(x, y) log p(x, y)
True Label
p(xi ) logb p(xi )
i=1
1
H(X) = −
n X
19356
17821
160
151379
0
1
Predicted Label
Fig. 2:matrix Baseline confusion matrix The confusion corresponding to the baseline scenario (without the inclusion of entropy-based features) indicates that the model exhibits a high capability for detecting malicious traffic, as evidenced by the high number of true positives (151,379) and the low number of false negatives (160). This behavior is desirable in
23466
13711
0.95
489
151051
0
1
0.90
Score
1
True Label
0
1.00
0.85
Predicted Label
Fig. 3: Confusion matrix with entropy-based feature
0.75
Just selection
With Entropy
Fig. 4: Comparative performance with and without entropy-based feature
M AC AN C E US P T CR E D IP T
intrusion detection systems, as it minimizes the occurrence of undetected attacks. However, a considerable number of false positives (17,821) are observed, which implies the incorrect classification of legitimate traffic as malicious. In real-world environments, this may lead to unnecessary alerts and potential degradation of network service availability and quality. With the introduction of the entropy-based features, the confusion matrix reveals a reduction in the number of false positives, decreasing to 13,711, indicating an improvement in the model’s ability to distinguish legitimate traffic patterns from anomalous ones. Additionally, the number of true negatives increases to 23,466, reinforcing this improvement. On the other hand, an increase in the number of false negatives (489) is observed, indicating that a portion of malicious traffic is no longer detected. Despite this, the model still maintains a high number of true positives (151,051), preserving strong detection capability. These results highlight a trade-off between reducing false positives and increasing false negatives, demonstrating that the proposed approach improves classification reliability while slightly impacting detection sensitivity. Next, Figure 4 presents a comparison of the performance of the network traffic classification model in scenarios with and without the inclusion of entropybased features, considering the metrics of accuracy, F1score, and precision. In the baseline scenario, where only feature selection is applied, the model achieves an accuracy of 0.9047±0.0005, an F1-score of 0.9439±0.0003, and a precision of 0.8947±0.0005, indicating strong performance in detecting malicious traffic. However, the relatively lower precision, combined with a higher false positive rate (0.4794±0.0026), highlights the presence of a considerable number of incorrect classifications of legitimate traffic as malicious, which may compromise system reliability in With theenvironments. inclusion of the entropy-based features, conreal-world sistent improvements are observed across the evaluated metrics, with accuracy reaching 0.9248±0.0003, the F1score 0.9551±0.0002, and precision 0.9168±0.0004. The increase in precision, along with the reduction in the false positive rate to 0.3688±0.0018, indicates a substantial improvement in the model’s ability to distinguish legitimate traffic from anomalous behavior, corroborating the observations from the confusion matrix analysis. At the
Accuracy F1 Score Precision
0.80
same time, a slight reduction in recall (0.9968±0.0001 compared to 0.9989±0.0001) and an increase in the false negative rate are observed, reflecting a trade-off between reducing false alarms and maintaining maximum detection sensitivity. Overall, although the improvements are not uniform across all performance aspects, the results demonstrate that the proposed approach enhances the model’s discriminative capability. In particular, the reduction in false positives, combined with the maintenance of a high detection rate, highlights the effectiveness of entropybased features in improving the balance between reliability and detection performance, which is critical for practical anomaly detection systems in network environments. Finally, Figures 5 and 6 compare memory usage and execution time between the evaluated scenarios. The inclusion of entropy-based features leads to an increase in execution time, rising from 1873.86 seconds in the baseline to 4632.05 seconds in the proposed approach. In terms of memory, the results show a different behavior: while the baseline presents a peak memory usage of 568.21 MB, the entropy-based approach reaches a slightly lower peak of 512.87 MB.
Peak Memory (MB)
Peak Memory Consumption
500 400 300 200 100 0
Just selection
With Entropy
Fig. 5: Peak memory consumption observed during execution The increase in execution time reflects the additional computational cost associated with the calculation of temporal and multidimensional entropy features, particularly
Execution Time (s)
Execution Time Comparison 4000 3000 2000 1000 0
Just selection
With Entropy
Fig. 6: Training and testing time
M AC AN C E US P T CR E D IP T
due to the use of sliding windows and joint probability distributions. As a result, the proposed method is more computationally demanding in terms of processing time compared to the baseline approach. On the other hand, this additional cost is accompanied by improved classification performance, particularly in terms of precision and overall balance between false positives and false negatives. Therefore, the results suggest that the proposed method represents a trade-off between computational efficiency and detection effectiveness. From a practical perspective, this trade-off may be acceptable in scenarios where detection reliability is prioritized over execution time, such as offline analysis or highcapacity environments. However, in real-time or latencysensitive systems, further optimizations may be required to reduce the computational overhead associated with entropy calculations. Overall, the observed reduction in false positives, combined with the preservation of high detection capability, highlights the practical value of the proposed approach. These findings reinforce that temporal and multidimensional entropy features provide a more expressive representation of network traffic, enabling improved anomaly detection at the cost of increased processing time.
operational efficiency. These results highlight that the proposed approach should be interpreted as a performanceoriented enhancement rather than a lightweight solution. However, the results also show that these improvements come at the cost of increased computational cost, particularly in terms of execution time, due to the additional processing required for entropy computation over sliding windows and joint distributions. This highlights an inherent trade-off between detection performance and computational efficiency, which must be considered depending on the target application scenario, especially in large-scale or time-sensitive environments. Overall, the findings indicate that entropy-based representations, when extended to capture temporal and multidimensional characteristics, can significantly enhance anomaly detection performance while providing a richer characterization of complex traffic patterns. Future work will focus on optimizing the computational efficiency of the proposed approach, as well as evaluating its applicability in real-time, distributed, and large-scale environments. Additionally, further investigation into adaptive mechanisms and integration with explainability techniques may contribute to more robust and interpretable intrusion detection systems.
V. Final Considerations
This work addresses the challenge of representing highdimensional and dynamic network data in complex environments such as smart cities, investigating the use of temporal and multidimensional entropy-based feature engineering to enhance network traffic anomaly detection. By modeling both structural relationships and temporal dynamics of traffic attributes, the proposed approach extends traditional entropy formulations and provides a more expressive representation of network behavior, albeit at a higher computational cost. Experimental results demonstrate that the proposed method improves the balance between false positives and false negatives, reducing false alarms while maintaining a high detection capability. This behavior is particularly relevant in practical intrusion detection systems, where excessive false positives may compromise usability and
References
[1] A. Quevedo, D. Ayres, G. Dimuro, A. Riker, G. Lucca, and B. L. Dalmazo, “Optimizing big data traffic prediction using generalizations of choquet integral with adaptive weighting,” in ICC 2025 - IEEE International Conference on Communications, pp. 4872–4877, 2025. [2] A. Quevedo, D. Ayres, G. Teixeira, G. Dimuro, G. Lucca, and B. L. Dalmazo, “Improving anomaly detection in network traffic using choquet-based feature engineering for random forest and xgboost models,” in Computational Science and Its Applications – ICCSA 2025, (Cham), pp. 3–16, Springer Nature Switzerland, 2025. [3] L. Leite, Y. Santo, B. Dalmazo, and A. Riker, “Federated learning under attack: Improving gradient inversion for batch of images,” in Anais do XXIV Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais, (Porto Alegre, RS, Brasil), pp. 794–800, SBC, 2024. [4] M. H. Nguyen, Y.-K. Lai, and K.-P. Chang, “An entropybased ddos attack detection and classification with hierarchical temporal memory,” in 2021 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), pp. 1942–1948, 2021. [5] B. L. Dalmazo, J. P. Vilela, and M. Curado, “Online traffic prediction in the cloud,” International Journal of Network Management, vol. 26, no. 4, pp. 269–285, 2016. [6] Z. Ma, J. Zhang, and M. Tang, “Optimized random forest for ddos attack detection in sdn environment,” in 2023 IEEE 10th International Conference on Cyber Security and Cloud Computing (CSCloud)/2023 IEEE 9th International Conference on Edge Computing and Scalable Cloud (EdgeCom), pp. 72–77, 2023. [7] Y. Chen, J. Hou, Q. Li, and H. Long, “Ddos attack detection based on random forest,” in 2020 IEEE International Conference on Progress in Informatics and Computing (PIC), pp. 328–334, 2020. [8] T. Visetbunditkun and W. Srichavengsup, “Ddos attack detection using ensemble machine learning models with rfe algorithm,” in 2022 7th International Conference on Business and Industrial Research (ICBIR), pp. 269–273, 2022.
M AC AN C E US P T CR E D IP T
[9] W. Ji, Y. Yang, Y. Zhang, Y. Wang, M. Tian, and Y. Qiu, “Ddos attack detection based on information entropy feature extraction in software defined networks,” in 2023 International Conference on Networking and Network Applications (NaNA), pp. 459–464, 2023. [10] F. Ali, S. Sarwar, Q. M. Shafi, M. Iqbal, M. Safyan, and Z. U. Qayyum, “Securing iot based maritime transportation system through entropy-based dual-stack machine learning framework,” IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 2, pp. 2482–2491, 2023. [11] O. Ali and P. Cotae, “Towards dos/ddos attack detection using artificial neural networks,” in 2018 9th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference, pp. 229–234, 2018. [12] A. D. Aguru and S. B. Erukala, “A lightweight ddos detection mechanism in iot networks using entropy and expectation of packet size,” in 2022 IEEE International Symposium on Smart Electronic Systems (iSES), pp. 101–106, 2022. [13] A. Alfatemi, D. Oliveira, M. Rahouti, A. Hafid, and N. Ghani, “Precision ddos detection through gaussian noise-augmented neural networks,” in 2024 15th International Conference on Network of the Future (NoF), pp. 178–185, 2024. [14] A. Alsirhani, S. Sampalli, and P. Bodorik, “Ddos detection system: Using a set of classification algorithms controlled by fuzzy logic system in apache spark,” IEEE Transactions on Network and Service Management, vol. 16, no. 3, pp. 936–949, 2019. [15] L. Tan, Y. Pan, J. Wu, J. Zhou, H. Jiang, and Y. Deng, “A new framework for ddos attack detection and defense in sdn environment,” IEEE Access, vol. 8, pp. 161908–161919, 2020. [16] H. Wang and Y. Li, “Overview of ddos attack detection in software-defined networks,” IEEE Access, vol. 12, pp. 38351– 38381, 2024. [17] S. Y. Mehr and B. Ramamurthy, “Hierarchical classic controllers (hcc) with an enhanced svm method for ddos attack detection in sdn,” in 2022 IEEE International Conference on Advanced Networks and Telecommunications Systems (ANTS), pp. 381– 386, 2022. [18] K. Saurabh, T. Kumar, U. Singh, O. Vyas, and R. Khondoker, “Nfdlm: A lightweight network flow based deep learning model for ddos attack detection in iot domains,” in 2022 IEEE World AI IoT Congress (AIIoT), pp. 736–742, 2022. [19] M. Yuan and G. Yang, “Ddos attack intrusion detection based on relative entropy-cnn,” in ISCTT 2021; 6th International Conference on Information Science, Computer Technology and Transportation, 2021. [20] J. Tan, S. Jing, L. Guo, and B. Xiao, “Ddos detection method based on gini impurity and random forest in sdn environment,” in 2021 International Conference on Security, Pattern Analysis, and Cybernetics(SPAC), pp. 601–606, 2021. [21] Y. Jia, F. Zhong, A. Alrawais, B. Gong, and X. Cheng, “Flowguard: An intelligent edge defense mechanism against iot ddos attacks,” IEEE Internet of Things Journal, vol. 7, no. 10, pp. 9552–9562, 2020. [22] S. Vattikuti, M. R. Hegde, M. Manish, V. Bodduvaram, and V. Sarasvathi, “Ddos attack detection and mitigation using anomaly detection and machine learning models,” in 2021 IEEE International Conference on Computation System and Information Technology for Sustainable Solutions (CSITSS), pp. 1–6, 2021. [23] I. Sharafaldin, A. Habibi Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” Jan. 2018.