ain reason entropy is used for DDOS detection is its ability to measure randomness in the packets that are coming to a network. The higher the randomness the higher is the entropy and vice versa. There are two important types of DDOS detection using entropy: Downloaded: 4/15/2022 9:44:49 AM Nova Southeastern University IP Address: 137.52.76.29 Analysis of Issues in SDN Security and Solutions Window size 2. Threshold Window size depends on a time period or a number of packets. Entropy is calculated within this window to measure uncertainty in the coming packets. We require a threshold to detect an attack. Calculated entropy if passes a threshold or is below it, depending on the scheme, an attack is detected. Say n be the number of packet in a window and p is the probability of each element in the window then, entropy will be calculated as: Entropy showcases packet headers as independent information symbols with distinct probability of occurrence. Selecting a window of some number, 10,000 for example, and moving the window forward, a pattern will emerge with probabilities for each type of packet header. Drastic changes in the bins of each header that varies from the average bin limits will alert the system of anomalies. H= - log Pi Entropy is a, fairly, common method for DDOS detection. Qin et al. (2014) propose a technique with a window of 0.1 seconds and three levels of threshold. This method is concerned with maintaining a strategic distance from false positives and false negatives in the system. However, as the authors mentioned, the method is time consuming and uses more resources. This method also uses a time period window. For the threshold, the authors ran several datasets to find a suitable experimental threshold and it is a multiple of the standard deviation of the entropy values. In this method, the false negatives are higher than other methods and false positives are lower. No percentage of accuracy is indicated. There is also no mention of resources used for fast computation. Nakashima, Sueyoshi, Oshim