Research Article
Multiple-Features-Based Semisupervised Clustering DDoS Detection Method
Table 3
Comparison of two algorithms running times using different detection features with different data size.
| | Feature | Data size | | 25% | 33.33% | 50% | 66.67% | 100% | | Algorithm | | -means | MF-CKM | -means | MF-CKM | -means | MF-CKM | -means | MF-CKM | -means | MF-CKM |
| | 13.8 ms | 13.4 ms | 14.8 ms | 14.4 ms | 20.0 ms | 17.5 ms | 20.6 ms | 18.0 ms | 23.3 ms | 20.1 ms | | 13.2 ms | 13.0 ms | 14.1 ms | 13.5 ms | 16.9 ms | 16.0 ms | 20.6 ms | 18.5 ms | 24.1 ms | 20.8 ms | | OWCD | 13.5 ms | 13.0 ms | 14.6 ms | 14.0 ms | 18.0 ms | 17.0 ms | 20.0 ms | 18.8 ms | 22.0 ms | 20.0 ms |
|
|
Remarks. : entropy of source IP; : entropy of destination IP.
|
