Fig. 6From: A cooperative DDoS attack detection scheme based on entropy and ensemble learning in SDNPreliminary detection result in the edge switch (ICMP). a: Real-time results of information entropy difference. b: Real-time statistic results of flow entries. c: Detection decision in the edge switch (0 represent normal, 1 represent abnormal)Back to article page