[Retracted] DDoS Detection Using a Cloud-Edge Collaboration Method Based on Entropy-Measuring SOM and KD-Tree in SDN

Algorithm 1

DDoS detection based on EMSOM-KD.

	Input: the detected flow vector, SOM map, abnormal neuron set , normal neuron set , suspicious neuron set , KD-tree.
	Output: the detection result.
(1)	For each network flow
(2)	Normalize the detected flow vector by (1).
(3)	Compute the best match neuron in the suitable SOM map.
(4)	If the best match neuron is in , then
	The detected flow is normal.
	Else if the best match neuron is in , then
	The detected flow is abnormal.
	Else
	The detected flow is suspicious.
	End if
(5)	End for
(4)	For each suspicious flow
	Search the nearest nodes in the KD-tree.
	Count the number of nodes of each type.
	If the number of normal nodes is more than , then
	The detected flow is normal.
	Else
	The detected flow is abnormal.
	End for