{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,24]],"date-time":"2026-10-24T01:13:04Z","timestamp":1792804384654,"version":"4.5.0"},"reference-count":140,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2015,4,20]],"date-time":"2015-04-20T00:00:00Z","timestamp":1429488000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Polish National Centre for Research and Development","award":["PBS1\/A3\/14\/2012"],"award-info":[{"award-number":["PBS1\/A3\/14\/2012"]}],"id":[{"id":"https:\/\/ror.org\/05pwfyy15","id-type":"ROR","asserted-by":"crossref"}]},{"name":"European Regional Development Fund the Innovative Economy Operational Programme","award":["01.01.02-00-062\/09"],"award-info":[{"award-number":["01.01.02-00-062\/09"]}]},{"name":"European Regional Development Fund the Innovative Economy Operational Programme","award":["02.03.00-14-106\/13"],"award-info":[{"award-number":["02.03.00-14-106\/13"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Data mining is an interdisciplinary subfield of computer science involving methods at the intersection of artificial intelligence, machine learning and statistics. One of the data mining tasks is anomaly detection which is the analysis of large quantities of data to identify items, events or observations which do not conform to an expected pattern. Anomaly detection is applicable in a variety of domains, e.g., fraud detection, fault detection, system health monitoring but this article focuses on application of anomaly detection in the field of network intrusion detection.The main goal of the article is to prove that an entropy-based approach is suitable to detect modern botnet-like malware based on anomalous patterns in network. This aim is achieved by realization of the following points: (i) preparation of a concept of original entropy-based network anomaly detection method, (ii) implementation of the method, (iii) preparation of original dataset, (iv) evaluation of the method.<\/jats:p>","DOI":"10.3390\/e17042367","type":"journal-article","created":{"date-parts":[[2015,4,21]],"date-time":"2015-04-21T06:26:47Z","timestamp":1429597607000},"page":"2367-2408","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":178,"title":["An Entropy-Based Network Anomaly Detection Method"],"prefix":"10.3390","volume":"17","author":[{"given":"Przemys\u0142aw","family":"Berezi\u0144ski","sequence":"first","affiliation":[{"name":"Systems' Department, Military Communication Institute, ul. Warszawska 22a, 05-130 Zegrze, Poland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bartosz","family":"Jasiul","sequence":"additional","affiliation":[{"name":"Systems' Department, Military Communication Institute, ul. Warszawska 22a, 05-130 Zegrze, Poland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4925-3271","authenticated-orcid":false,"given":"Marcin","family":"Szpyrka","sequence":"additional","affiliation":[{"name":"Department of Applied Computer Science, AGH University of Science and Technology, al. Mickiewicza 30, 30-059 Krakow, Poland"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2015,4,20]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"222","DOI":"10.1109\/TSE.1987.232894","article-title":"An intrusion-detection model","volume":"13","author":"Denning","year":"1987","journal-title":"IEEE Trans. Softw. Eng."},{"key":"ref_2","first-page":"702","article-title":"USAID: Unifying Signature-Based and Anomaly-Based Intrusion Detection","volume":"3518","author":"Ho","year":"2005","journal-title":"Advances in Knowledge Discovery and Data Mining"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1011","DOI":"10.1109\/SURV.2011.092311.00082","article-title":"Evasion Techniques: Sneaking through Your Intrusion Detection\/Prevention Systems","volume":"14","author":"Cheng","year":"2012","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_4","unstructured":"Ganzha, M., Maciaszek, L., and Paprzycki, M. (2014, January 7\u201310). Identification of malware activities with rules. Warsaw, Poland."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"613","DOI":"10.1016\/j.cose.2011.08.010","article-title":"Analysis of update delays in signature-based network intrusion detection systems","volume":"30","author":"Gascon","year":"2011","journal-title":"Comput. Secur."},{"key":"ref_6","unstructured":"Eimann, R. (2008). Network Event Detection with Entropy Measures. [Ph.D. Thesis, University of Auckland]."},{"key":"ref_7","unstructured":"Wagner, A., and Plattner, B. (2005, January 13\u201315). Entropy Based Worm and Anomaly Detection in Fast IP Networks. Link\u00f6ping University, Link\u00f6ping, Sweden."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Nychis, G., Sekar, V., Andersen, D.G., Kim, H., and Zhang, H. (2008, January 20\u201322). An Empirical Evaluation of Entropy-based Traffic Anomaly Detection. Vouliagmeni, Greece.","DOI":"10.1145\/1452520.1452539"},{"key":"ref_9","unstructured":"Tellenbach, B. (2012). Detection, Classification and Visualization of Anomalies using Generalized Entropy Metrics. [Ph.D. Thesis, ETH]. Ph.D Dissertation Nr. 20929."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"426","DOI":"10.1109\/TIFS.2011.2107320","article-title":"Low-Rate DDoS Attacks Detection and Traceback by Using New Information Metrics","volume":"6","author":"Xiang","year":"2011","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"89","DOI":"10.1109\/JCN.2008.6388332","article-title":"Mutual information applied to anomaly detection","volume":"10","author":"Kopylova","year":"2008","journal-title":"J. Commun. Netw."},{"key":"ref_12","unstructured":"Available online: http:\/\/www.bitpipe.com\/detail\/RES\/1384218191_706.html."},{"key":"ref_13","unstructured":"Available online: https:\/\/cccure.training\/m\/articles\/view\/Sophos-Security-Threat-Report-2014."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Scanlon, M., and Kechadi, M.T. (2014, January 24\u201325). The Case for a Collaborative Universal Peer-to-Peer Botnet Investigation Framework. Purdue University, West Lafayette, IN, USA.","DOI":"10.1109\/ARES.2013.91"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Tellenbach, B., Burkhart, M., Sornette, D., and Maillart, T. (2009, January 1\u20133). Beyond Shannon: Characterizing Internet Traffic with Generalized Entropy Metrics. Seoul, Korea.","DOI":"10.1007\/978-3-642-00975-4_24"},{"key":"ref_16","unstructured":"NfSen\u2014Netflow Sensor. Available online: http:\/\/nfsen.sourceforge.net."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Barford, P., Kline, J., Plonka, D., and Ron, A. (2002, January 6\u20138). A Signal Analysis of Network Traffic Anomalies. Marseille, France.","DOI":"10.1145\/637201.637210"},{"key":"ref_18","unstructured":"Kim, M.S., Kong, H.J., Hong, S.C., Chung, S.H., and Hong, J. (2004, January 19\u201323). A flow-based method for abnormal network traffic detection. Seoul, Korea."},{"key":"ref_19","unstructured":"NtopNg\u2014High-Speed Web-based Traffic Analysis and Flow Collection. Available online: http:\/\/www.ntop.org."},{"key":"ref_20","unstructured":"Witten, I.H., Frank, E., and Hall, M.A. (2011). Data Mining: Practical Machine Learning Tools and Techniques, Morgan Kaufmann Publishers Inc. [3rd ed]."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Bhattacharyya, D.K., and Kalita, J.K. (2013). Network Anomaly Detection: A Machine Learning Perspective, Chapman & Hall\/CRC.","DOI":"10.1201\/b15088"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Aggarwal, C. (2013). Outlier Analysis, Springer.","DOI":"10.1007\/978-1-4614-6396-2"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Hastie, T., Tibshirani, R., and Friedman, J. (2009). The Elements of Statistical Learning: Data Mining, Inference and Prediction, Springer. [2 ed].","DOI":"10.1007\/978-0-387-84858-7"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"15:1","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly Detection: A Survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comput. Surv."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1023\/B:AIRE.0000045502.10941.a9","article-title":"A Survey of Outlier Detection Methodologies","volume":"22","author":"Hodge","year":"2004","journal-title":"Artif. Intell. Rev."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1569","DOI":"10.1016\/j.comcom.2004.07.002","article-title":"Anomaly Detection Methods in Wired Networks: A Survey and Taxonomy","volume":"27","year":"2004","journal-title":"Comput. Commun."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"3448","DOI":"10.1016\/j.comnet.2007.02.001","article-title":"An Overview of Anomaly Detection Techniques: Existing Solutions and Latest Technological Trends","volume":"51","author":"Patcha","year":"2007","journal-title":"Comput. Netw."},{"key":"ref_28","unstructured":"Callegari, C. (2009, January 24\u201328). Statistical approaches for network anomaly detection. Venice\/Mestre, Italy."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1109\/SURV.2009.090304","article-title":"A Survey on Internet Traffic Identification","volume":"11","author":"Callado","year":"2009","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","article-title":"Anomaly-based network intrusion detection: Techniques, systems and challenges","volume":"28","author":"Vazquez","year":"2009","journal-title":"Comput. Secur."},{"key":"ref_31","first-page":"1","article-title":"Network anomaly detection: methods, systems and tools","volume":"16","author":"Bhuyan","year":"2013","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"343","DOI":"10.1109\/SURV.2010.032210.00054","article-title":"An Overview of IP Flow-Based Intrusion Detection","volume":"12","author":"Sperotto","year":"2010","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Huang, L., Nguyen, X., Garofalakis, M., Jordan, M., Joseph, A.D., and Taft, N. (2007). In-Network PCA and Anomaly Detection, EECS Department, University of California.","DOI":"10.7551\/mitpress\/7503.003.0082"},{"key":"ref_34","unstructured":"Shyu, M.-L., Chen, S.-C., Sarinnapakorn, K., and Chang, L. (2003, January 19\u201322). A novel anomaly detection scheme based on principal component classifier. Melbourne, FL, USA."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1460","DOI":"10.1109\/TKDE.2012.99","article-title":"Anomaly Detection via Online Oversampling Principal Component Analysis","volume":"25","author":"Lee","year":"2013","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Lu, W., and Ghorbani, A.A. (2009). Network Anomaly Detection Based on Wavelet Analysis. EURASIP J. Adv. Sig. Proc., 2009.","DOI":"10.1155\/2009\/837601"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Lu, W., Tavallaee, M., and Ghorbani, A.A. (2008, January 5\u20138). Detecting Network Anomalies Using Different Wavelet Basis Functions. Halifax, Nova Scotia, Canada.","DOI":"10.1109\/CNSR.2008.75"},{"key":"ref_38","unstructured":"Limthong, K., Watanapongse, P., and Kensuke, F. (2010, January 15\u201318). A wavelet-based anomaly detection for outbound network traffic. Kuching, Sarawak, Malaysia."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"116","DOI":"10.1109\/TR.2004.823851","article-title":"Robustness of the Markov-chain model for cyber-attack detection","volume":"53","author":"Ye","year":"2004","journal-title":"IEEE Trans. Reliab."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Sha, W., Zhu, Y., Huang, T., Qiu, M., Zhu, Y., and Zhang, Q. (2013, January 22\u201326). A Multi-order Markov Chain Based Scheme for Anomaly Detection. Kyoto, Japan.","DOI":"10.1109\/COMPSACW.2013.12"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1007\/978-3-642-30507-8_13","article-title":"Unsupervised Clustering Approach for Network Anomaly Detection","volume":"293","author":"Syarif","year":"2012","journal-title":"Networked Digital Technologies"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Riad, A., Elhenawy, I., Hassan, A., and Awadallah, N. (2013). Visualize Network Anomaly Detection By Using K-Means Clustering Algorithm. Int. J. Comput. Netw. Commun., 5.","DOI":"10.5121\/ijcnc.2013.5514"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Bazan, J., Szpyrka, M., Szczur, A., Dydo, L., and Wojtowicz, H. (2015). Classifiers for Behavioral Patterns Identification Induced from Huge Temporal Data. Fundam. Inform., in press.","DOI":"10.3233\/FI-2016-1301"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1109\/TNSM.2009.090604","article-title":"Histogram-based Traffic Anomaly Detection","volume":"6","author":"Kind","year":"2009","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Soule, A., Salamatia, K., Taft, N., Emilion, R., and Papagiannaki, K. (2004, January 12\u201316). Flow Classification by Histograms: Or How to Go on Safari in the Internet. Columbia University, New York, NY, USA.","DOI":"10.1145\/1005686.1005696"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Stoecklin, M.P., Le Boudec, J.Y., and Kind, A. (2008, January 29\u201330). A Two-layered Anomaly Detection Technique Based on Multi-modal Flow Behavior Models. Cleveland, OH, USA.","DOI":"10.1007\/978-3-540-79232-1_22"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Brauckhoff, D., Dimitropoulos, X., Wagner, A., and Salamatian, K. (2009, January 4\u20136). Anomaly Extraction in Backbone Networks Using Association Rules. Chicago, IL, USA.","DOI":"10.1145\/1644893.1644897"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"74","DOI":"10.3390\/e17010074","article-title":"Entropy-Based Characterization of Internet Background Radiation","volume":"17","author":"Iglesias","year":"2014","journal-title":"Entropy"},{"key":"ref_49","unstructured":"Harrington, D., Presuhn, R., and Wijnen, B. An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks. Available online: http:\/\/www.ietf.org\/rfc\/rfc3411.txt."},{"key":"ref_50","unstructured":"Claise, B. Cisco Systems NetFlow Services Export Version 9. Available online: http:\/\/tools.ietf.org\/html\/rfc3954."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"226","DOI":"10.1016\/j.comcom.2010.02.010","article-title":"DoS attacks exploiting signaling in {UMTS} and {IMS}","volume":"34","author":"Kambourakis","year":"2011","journal-title":"Comput. Commun."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"4091","DOI":"10.3390\/en5104091","article-title":"Intrusion Detection of NSM Based DoS Attacks Using Data Mining in Smart Grid","volume":"5","author":"Choi","year":"2012","journal-title":"Energies"},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1049\/iet-com.2008.0702","article-title":"Fair incentive mechanism with pyramidal structure for peer-to-peer networks","volume":"4","author":"Liu","year":"2010","journal-title":"IET Commun."},{"key":"ref_54","unstructured":"Lee, D.C., Park, B., Kim, K.E., and Lee, J.J. (2009, January 15\u201318). Fast Traffic Anomalies Detection Using SNMP MIB Correlation Analysis. Phoenix Park, Korea."},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1007\/978-3-642-04576-9_7","article-title":"Volume Anomaly Detection in Data Networks: An Optimal Detection Algorithm vs. the PCA Approach","volume":"5464","author":"Valadas","year":"2009","journal-title":"Traffic Management and Traffic Engineering for the Future Internet"},{"key":"ref_56","unstructured":"Plixer Scrutinizer\u2014Incydent Response System. Available online: http:\/\/www.plixer.com."},{"key":"ref_57","unstructured":"Available online: http:\/\/www.paessler.com."},{"key":"ref_58","unstructured":"Available online: http:\/\/www.solarwinds.com."},{"key":"ref_59","unstructured":"Available online: https:\/\/www.invea.com."},{"key":"ref_60","unstructured":"Available online: http:\/\/www.akmalabs.com."},{"key":"ref_61","doi-asserted-by":"crossref","unstructured":"Jingle, I., and Rajsingh, E. (2014). ColShield: An effective and collaborative protection shield for the detection and prevention of collaborative flooding of DDoS attacks in wireless mesh networks. Human-centric Comput. Inf. Sci., 4.","DOI":"10.1186\/s13673-014-0008-8"},{"key":"ref_62","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1016\/j.future.2013.08.002","article-title":"Detection and defense of application-layer {DDoS} attacks in backbone web traffic","volume":"38","author":"Zhou","year":"2014","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Brauckhoff, D., Tellenbach, B., Wagner, A., May, M., and Lakhina, A. (2006, January 25\u201327). Impact of Packet Sampling on Anomaly Detection Metrics. Rio de Janeiro, Brazil.","DOI":"10.1145\/1177080.1177101"},{"key":"ref_64","doi-asserted-by":"crossref","unstructured":"Lakhina, A., Crovella, M., and Diot, C. (2005, January 22\u201326). Mining Anomalies Using Traffic Feature Distributions. Philadelphia, PA, USA.","DOI":"10.1145\/1080091.1080118"},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","article-title":"A Mathematical Theory of Communication","volume":"27","author":"Shannon","year":"1948","journal-title":"Bell Syst. Tech. J."},{"key":"ref_66","doi-asserted-by":"crossref","first-page":"1945","DOI":"10.3390\/e13111945","article-title":"A Characterization of Entropy in Terms of Information Loss","volume":"13","author":"Baez","year":"2011","journal-title":"Entropy"},{"key":"ref_67","unstructured":"Lee, W., and Xiang, D. (2001, January 14\u201316). Information-theoretic measures for anomaly detection. Oakland, CA, USA."},{"key":"ref_68","doi-asserted-by":"crossref","first-page":"497","DOI":"10.1023\/A:1025011119492","article-title":"Kolmogorov Complexity and Information Theory. With an Interpretation in Terms of Questions and Answers","volume":"12","year":"2003","journal-title":"J. Logic Lang. Inf."},{"key":"ref_69","doi-asserted-by":"crossref","first-page":"595","DOI":"10.3390\/e13030595","article-title":"Entropy Measures vs. Kolmogorov Complexity","volume":"13","author":"Teixeira","year":"2011","journal-title":"Entropy"},{"key":"ref_70","doi-asserted-by":"crossref","unstructured":"Ranjan, S., Shah, S., Nucci, A., Munafo, M., Cruz, R., and Muthukrishnan, S. (2007, January 6\u201312). DoWitcher: Effective Worm Detection and Containment in the Internet Core. Anchorage, AL, USA.","DOI":"10.1109\/INFCOM.2007.317"},{"key":"ref_71","doi-asserted-by":"crossref","unstructured":"Gu, Y., McCallum, A., and Towsley, D. (2005, January 19\u201321). Detecting Anomalies in Network Traffic Using Maximum Entropy Estimation. Berkeley, CA, USA.","DOI":"10.1145\/1330107.1330148"},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Speidel, U., Eimann, R., and Brownlee, N. (2007, January 10\u201313). Detecting network events via T-entropy. Singapore, Singapore.","DOI":"10.1109\/ICICS.2007.4449642"},{"key":"ref_73","unstructured":"Eimann, R., Speidel, U., and Brownlee, J. (2005, January 27\u201330). A T-entropy Analysis of the Slammer Worm Outbreak. Okinawa, Japan."},{"key":"ref_74","first-page":"443","article-title":"Deterministic Complexity and Entropy","volume":"64","author":"Titchener","year":"2005","journal-title":"Fundam. Inform."},{"key":"ref_75","unstructured":"Pawelec, J., Berezi\u0144ski, P., Piotrowski, R., and Chamela, W. (, January date). Entropy Measures For Internet Traffic Anomaly Detection. hlcity, country."},{"key":"ref_76","doi-asserted-by":"crossref","first-page":"479","DOI":"10.1007\/BF01016429","article-title":"Possible generalization of Boltzmann-Gibbs statistics","volume":"52","author":"Tsallis","year":"1988","journal-title":"J. Stat. Phys."},{"key":"ref_77","doi-asserted-by":"crossref","first-page":"1765","DOI":"10.3390\/e13101765","article-title":"The Nonadditive Entropy Sq and Its Applications in Physics and Elsewhere: Some Remarks","volume":"13","author":"Tsallis","year":"2011","journal-title":"Entropy"},{"key":"ref_78","doi-asserted-by":"crossref","first-page":"701","DOI":"10.3390\/e14040701","article-title":"Tsallis Relative Entropy and Anomalous Diffusion","volume":"14","author":"Prehl","year":"2012","journal-title":"Entropy"},{"key":"ref_79","unstructured":"Renyi, A. (1970). Probability Theory, North-Holland."},{"key":"ref_80","doi-asserted-by":"crossref","first-page":"261","DOI":"10.3390\/e10030261","article-title":"Axiomatic Characterizations of Information Measures","volume":"10","year":"2008","journal-title":"Entropy"},{"key":"ref_81","doi-asserted-by":"crossref","first-page":"1034","DOI":"10.1109\/LCOMM.2007.070761","article-title":"Network anomaly detection using nonextensive entropy","volume":"11","author":"Ziviani","year":"2007","journal-title":"IEEE Commun. Lett."},{"key":"ref_82","doi-asserted-by":"crossref","unstructured":"Shafiq, M.Z., Khayam, S.A., and Farooq, M. (2008, January 12\u201316). Improving Accuracy of Immune-inspired Malware Detectors by Using Intelligent Features. Atlanta, GA, USA.","DOI":"10.1145\/1389095.1389112"},{"key":"ref_83","doi-asserted-by":"crossref","unstructured":"Lima, C.F.L., de Assis, F.M., and de Souza, C.P. (2012, January 29\u201331). A Comparative Study of Use of Shannon, R\u00e9nyi and Tsallis Entropy for Attribute Selecting in Network Intrusion Detection. Natal, Brazil.","DOI":"10.1007\/978-3-642-32639-4_60"},{"key":"ref_84","doi-asserted-by":"crossref","first-page":"3485","DOI":"10.1016\/j.comnet.2011.07.008","article-title":"Accurate Network Anomaly Classification with Generalized Entropy Metrics","volume":"55","author":"Tellenbach","year":"2011","journal-title":"Comput. Netw."},{"key":"ref_85","first-page":"1","article-title":"Robust Network Traffic Classification","volume":"PP","author":"Zhang","year":"2014","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_86","unstructured":"Clausius, R., and Hirst, T. (1867). The Mechanical Theory of Heat: With its applications to the steam-engine and to the physical properties of bodies, J. van Voorst."},{"key":"ref_87","doi-asserted-by":"crossref","unstructured":"Karmeshu, J. (2003). Entropy Measures, Maximum Entropy Principle and Emerging Applications, Springer.","DOI":"10.1007\/978-3-540-36212-8"},{"key":"ref_88","doi-asserted-by":"crossref","first-page":"191","DOI":"10.3390\/e3030191","article-title":"Maximum Entropy Fundamentals","volume":"3","author":"Harremoes","year":"2001","journal-title":"Entropy"},{"key":"ref_89","unstructured":"Kullback, S. (1959). Information Theory and Statistics, Wiley."},{"key":"ref_90","doi-asserted-by":"crossref","unstructured":"Cover, T., and Thomas, J. (2006). Elements of Information Theory, Wiley.","DOI":"10.1002\/047174882X"},{"key":"ref_91","doi-asserted-by":"crossref","first-page":"643","DOI":"10.1007\/978-3-540-69731-2_62","article-title":"Comparison of Shannon, Renyi and Tsallis Entropy Used in Decision Trees","volume":"5097","author":"Rutkowski","year":"2008","journal-title":"Artificial Intelligence and Soft Computing\u2014ICAISC 2008"},{"key":"ref_92","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1016\/j.physleta.2005.01.094","article-title":"A step beyond Tsallis and R\u00e9nyi entropies","volume":"338","author":"Marco","year":"2005","journal-title":"Phys. Lett. A"},{"key":"ref_93","unstructured":"W\u0229drowska, E. (2012). Miary entropii i dywergencji w analizie struktur, Wydawnictwo Uniwersytetu Warminsko-Mazurskiego."},{"key":"ref_94","unstructured":"Softflowd\u2014Flow-based Network Traffic Analyser. Available online: http:\/\/code.google.com\/p\/softflowd\/."},{"key":"ref_95","unstructured":"Gigamon\u2014SPAN Port Or TAP? White Paper. Available online: https:\/\/www.netdescribe.com\/downloads\/span_port_or_tap_web.pdf."},{"key":"ref_96","unstructured":"Trammell, B., Wagner, A., and Claise, B. Flow Aggregation for the IP Flow Information Export (IPFIX) Protocol. Available online: http:\/\/tools.ietf.org\/html\/rfc7015."},{"key":"ref_97","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.scitotenv.2004.11.023","article-title":"Background and threshold: critical comparison of methods of determination","volume":"346","author":"Reimann","year":"2005","journal-title":"Sci. Total Environ."},{"key":"ref_98","doi-asserted-by":"crossref","first-page":"277","DOI":"10.1007\/978-3-642-40925-7_26","article-title":"Telecommunications Networks Risk Assessment with Bayesian Networks","volume":"8104","author":"Saeed","year":"2013","journal-title":"Computer Information Systems and Industrial Management"},{"key":"ref_99","doi-asserted-by":"crossref","first-page":"10","DOI":"10.1145\/1656274.1656278","article-title":"The WEKA Data Mining Software: An Update","volume":"11","author":"Hall","year":"2009","journal-title":"SIGKDD Explor. Newslett."},{"key":"ref_100","doi-asserted-by":"crossref","first-page":"6602","DOI":"10.3390\/e16126602","article-title":"Detection and Modeling of Cyber Attacks with Petri Nets","volume":"16","author":"Jasiul","year":"2014","journal-title":"Entropy"},{"key":"ref_101","doi-asserted-by":"crossref","first-page":"667","DOI":"10.1007\/978-3-662-45237-0_60","article-title":"Malware Behavior Modeling with Colored Petri Nets","volume":"8838","author":"Saeed","year":"2014","journal-title":"Computer Information Systems and Industrial Management"},{"key":"ref_102","doi-asserted-by":"crossref","first-page":"475","DOI":"10.1007\/978-3-662-45402-2_71","article-title":"Formal Specification of Malware Models in the Form of Colored Petri Nets","volume":"330","author":"Park","year":"2015","journal-title":"Computer Science and its Applications"},{"key":"ref_103","unstructured":"ACM Sigcomm Internet Traffic Archive. Available online: http:\/\/www.sigcomm.org\/ITA."},{"key":"ref_104","unstructured":"Lawrence Berkeley National Laboratory\/International Computer Science Institute Enterprise Tracing. Available online: http:\/\/www.icir.org\/enterprise-tracing\/."},{"key":"ref_105","unstructured":"SimpleWeb Available online: http:\/\/www.simpleweb.org\/wiki\/Traces."},{"key":"ref_106","unstructured":"Center for Applied Internet Data Analysis (CAIDA) Available online: http:\/\/www.caida.org\/data\/overview."},{"key":"ref_107","unstructured":"Cluster of European Projects aimed at Monitoring and Measurement (MoMe). Available online: http:\/\/www.ist-mome.org\/database\/MeasurementData."},{"key":"ref_108","unstructured":"Waikato Internet Traffic Storage (WITS) Available online: http:\/\/wand.net.nz\/wits."},{"key":"ref_109","unstructured":"UMass Trace Repository (UMass) Available online: http:\/\/traces.cs.umass.edu."},{"key":"ref_110","unstructured":"Verizon Data Breach Investigations Report. Available online: http:\/\/www.verizonenterprise.com\/DBIR\/2014\/(accessed."},{"key":"ref_111","unstructured":"Available online: http:\/\/www.symantec.com\/security_response\/publications\/threatreport.jsp."},{"key":"ref_112","unstructured":"Availableonline: http:\/\/www.cert.pl\/PDF\/Report_CP_2013.pdf."},{"key":"ref_113","doi-asserted-by":"crossref","unstructured":"Saad, S., Traore, I., Ghorbani, A.A., Sayed, B., Zhao, D., Lu, W., Felix, J., and Hakimian, P. (2011, January 19\u201321). Detecting P2P botnets through network behavior analysis and machine learning. Montreal, QC, Canada.","DOI":"10.1109\/PST.2011.5971980"},{"key":"ref_114","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1016\/j.cose.2014.05.011","article-title":"An Empirical Comparison of Botnet Detection Methods","volume":"45","author":"Grill","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_115","doi-asserted-by":"crossref","unstructured":"Sperotto, A., Sadre, R., Vliet, F., and Pras, A. (2009, January 29\u201330). A Labeled Data Set for Flow-Based Intrusion Detection. Venice, Italy.","DOI":"10.1007\/978-3-642-04968-2_4"},{"key":"ref_116","unstructured":"Zamojski, W., Mazurkiewicz, J., Sugier, J., Walkowiak, T., and Kacprzyk, J. (\u2013, January 30). Entropy-Based Internet Traffic Anomaly Detection: A Case Study. Brun\u00f3w, Poland."},{"key":"ref_117","unstructured":"Haines, J., Lippmann, R., Fried, D., Zissman, M., Tran, E., and Boswell, S. Available online: https:\/\/www.ll.mit.edu\/mission\/communications\/cyber\/CSTcorpora\/files\/TR-1062.pdf."},{"key":"ref_118","unstructured":"The Third International Knowledge Discovery and Data Mining Tools (KDD) Cup 1999 Data. Available online: http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html."},{"key":"ref_119","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A Detailed Analysis of the KDD CUP 99 Data Set. Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_120","doi-asserted-by":"crossref","first-page":"262","DOI":"10.1145\/382912.382923","article-title":"Testing Intrusion Detection Systems: A Critique of the 1998 and 1999 DARPA Intrusion Detection System Evaluations As Performed by Lincoln Laboratory","volume":"3","author":"McHugh","year":"2000","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"ref_121","doi-asserted-by":"crossref","first-page":"220","DOI":"10.1007\/978-3-540-45248-5_13","article-title":"An Analysis of the 1999 DARPA\/Lincoln Laboratory Evaluation Data for Network Anomaly Detection","volume":"2820","author":"Vigna","year":"2003","journal-title":"Recent Advances in Intrusion Detection"},{"key":"ref_122","doi-asserted-by":"crossref","unstructured":"Thomas, C., Sharma, V., and Balakrishnan, N. (2008). Usefulness of DARPA dataset for intrusion detection system evaluation. SPIE Proc.","DOI":"10.1117\/12.777341"},{"key":"ref_123","unstructured":"Brauckhoff, D., Wagner, A., and May, M. (2008, January 28). FLAME: A Flow-level Anomaly Modeling Engine. San Jose, CA, USA."},{"key":"ref_124","unstructured":"Brauckhoff, D. (2010). Network traffic anomaly detection and evaluation. [Ph.D. Thesis, ETH Z\u00fcrich]. PhD Dissertation Nr. 18835."},{"key":"ref_125","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","article-title":"Toward Developing a Systematic Approach to Generate Benchmark Datasets for Intrusion Detection","volume":"31","author":"Shiravi","year":"2012","journal-title":"Comput. Secur."},{"key":"ref_126","doi-asserted-by":"crossref","first-page":"465","DOI":"10.1007\/978-3-662-45237-0_43","article-title":"Network Anomaly Detection Using Parameterized Entropy","volume":"8838","author":"Saeed","year":"2014","journal-title":"Computer Information Systems and Industrial Management"},{"key":"ref_127","unstructured":"Tomer, B. Available online: http:\/\/blog.imperva.com\/2011\/09\/morto-post-mortem-a-worm-deep-dive.html."},{"key":"ref_128","doi-asserted-by":"crossref","unstructured":"Damon, E., Dale, J., Laron, E., Mache, J., Land, N., and Weiss, R. (2012, January 12\u201313). Hands-on Denial of Service Lab Exercises Using SlowLoris and RUDY. Kennesaw, GA, USA.","DOI":"10.1145\/2390317.2390321"},{"key":"ref_129","doi-asserted-by":"crossref","first-page":"971","DOI":"10.3390\/fi4040971","article-title":"The Cousins of Stuxnet: Duqu, Flame, and Gauss","volume":"4","year":"2012","journal-title":"Future Internet"},{"key":"ref_130","doi-asserted-by":"crossref","first-page":"672","DOI":"10.3390\/fi4030672","article-title":"Stuxnet: What Has Changed?","volume":"4","author":"Denning","year":"2012","journal-title":"Future Internet"},{"key":"ref_131","unstructured":"K\u00fchrer, M., Hupperich, T., Rossow, C., and Holz, T. (2014, January 20\u201322). Exit from Hell? Reducing the Impact of Amplification DDoS Attacks. San Diego, CA, USA."},{"key":"ref_132","first-page":"87","article-title":"Comparison of Values of Pearson\u2019s and Spearman\u2019s Correlation Coefficients on the Same Sets of Data","volume":"30","author":"Hauke","year":"2011","journal-title":"Quaest. Geogr."},{"key":"ref_133","doi-asserted-by":"crossref","unstructured":"Davis, J., and Goadrich, M. (2006, January 25\u201329). The Relationship Between Precision-Recall and ROC Curves. Pittsburgh, PA, USA.","DOI":"10.1145\/1143844.1143874"},{"key":"ref_134","doi-asserted-by":"crossref","first-page":"1375","DOI":"10.3390\/e15041375","article-title":"Classification of Knee Joint Vibration Signals Using Bivariate Feature Distribution Estimation and Maximal Posterior Probability Decision Criterion","volume":"15","author":"Wu","year":"2013","journal-title":"Entropy"},{"key":"ref_135","unstructured":"Rifkin, R. Available online: http:\/\/www.mit.edu\/~9.520\/spring09\/Classes\/multiclass.pdf."},{"key":"ref_136","doi-asserted-by":"crossref","unstructured":"Sumner, M., Frank, E., and Hall, M. (2005, January 3\u20137). Speeding up Logistic Model Tree Induction. Porto, Portugal.","DOI":"10.1007\/11564126_72"},{"key":"ref_137","unstructured":"Seber, G., and Lee, A. (2012). Linear Regression Analysis, Wiley."},{"key":"ref_138","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1007\/s10994-005-0466-3","article-title":"Logistic Model Trees","volume":"59","author":"Landwehr","year":"2005","journal-title":"Mach. Learn."},{"key":"ref_139","doi-asserted-by":"crossref","first-page":"3084","DOI":"10.1016\/j.patcog.2012.03.004","article-title":"An Extensive Experimental Comparison of Methods for Multi-label Learning","volume":"45","author":"Madjarov","year":"2012","journal-title":"Pattern Recogn."},{"key":"ref_140","unstructured":"Available online: http:\/\/meka.sourceforge.net\/."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/17\/4\/2367\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T20:44:58Z","timestamp":1760215498000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/17\/4\/2367"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,4,20]]},"references-count":140,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2015,4]]}},"alternative-id":["e17042367"],"URL":"https:\/\/doi.org\/10.3390\/e17042367","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,4,20]]}}}