Entropy based network anomaly detection

Abstract

an era of relentless cyber threats, the increasing complexity and volume of data significantly intensify the risk and impact of cybersecurity breaches. As organizations generate and store more data, the potential attack surface grows, providing more opportunities for malicious actors to exploit vulnerabilities. Consequently, there is a growing necessity for more advanced analytical techniques to effectively detect and mitigate these evolving threats. Shannon entropy, introduced by Claude Shannon in 1948, is a fundamental concept in information theory that measures the unpredictability or randomness of information. It serves as a primary tool for identifying unusual patterns within extensive datasets, offering a quantitative approach to detect anomalies This paper explores the application of Shannon’s Entropy to detect and prevent distributed denial-of-service (DDoS) attacks. Unlike traditional motif identification tools, which focus on recurring patterns within data, Shannon entropy provides a broader measure of randomness and can detect subtle variations that may indicate a security breach. By leveraging the entropy measure, cybersecurity systems can identify and respond to abnormal traffic patterns that signify a potential DDoS attack, thereby enhancing the robustness and reliability of data protection mechanisms