network based DDoS attack respectively. The blemish and dearth in operations can crash applications or consume a formidable amount of computer resources easily though the traffic of host based attacks may not be as high as network based attacks. Attack Network Distributed attacking hosts can commence multiple DoS attacks (also called DDoS attacks). The DDoS attack is put into motion following a two-step development procedure. The attack is initialized by developing a network with encroachment capabilities consisting of an inordinate surplus of jeopardizing computer systems (called zombies, bots, or attacking hosts) and distributing it across multiple host systems. After this, a colossal volume of traffic is send across the victim's machine either by the attacker or is self-regulated. Such attack network is a consequence of poorly structured and unimmunized computers of users. The impregnability of a vulnerable host can be jeopardized by following two proposals. The first one includes running malevolent programs namely, virus, Trojans, spyware etc. integrated in emails, web pages, files etc. The second proposal is carried through computerized programs namely, worms which can mechanically examine the vulnerable nature of remote computers. Taking undue advantage of this susceptibility, the attackers exploit user's system by rupturing into it and installing programs initiating DoS attack. Furthermore, heterogeneous other hosts are scanned and flood packets, backdoors are installed by the attacker. Hence, the attacker is referred to as the master of these compromised computers (zombies). The latter is capable of registering the vulnerable systems as an associate in the scenario of a complex network attack. It is a self-propagating network where the compromised systems repeat this procedure and exploit other computers with similar glitches. Thus, interruption or attack in one system can create a gigantic attack network consisting of thousands of computers. DDOS DETECTION USING ENTROPY Entropy measures randomness. The m