ANUJ
DATA×AI×ENGINEERING
INITIALIZING SYSTEM
ANUJ MUNDU
RETURN TO SELECTED WORK
SOURCE CODE
PROJECT 14•DATA ANALYTICS•DATA ANALYTICS

Entropy-Based DDoS Anomaly Detection Platform

Full-stack simulation platform detecting anomalous traffic patterns using Shannon entropy statistical analysis

ReactNode.jsExpressChart.jsCybersecurityEntropy AnalysisReal-Time Telemetry
Algorithm
Shannon Entropy
Information theory statistical analysis
Telemetry
Real-Time
Interactive Chart.js visual dashboard
Evaluation
F1 / Accuracy
Automated precision, recall, and detection latency
Architecture
Full-Stack
Decoupled React frontend + Node.js simulation engine
// INTERACTIVE SYSTEM TELEMETRY & DIAGNOSTIC LAB
INTERACTIVE DECISION THRESHOLD CALIBRATOR (τ)

Slide the classification cut-off threshold to evaluate precision vs recall trade-offs and net ROI.

OPTIMAL τ:0.42 (Brier Calibrated)
DECISION BOUNDARY (THRESHOLD τ):0.42
0.15 (High Sensitivity / Catch All)0.80 (High Specificity / Conservative)
Precision
80.8%
Targeting accuracy
Recall
81.2%
Churners captured
F1 Score
81%
Harmonic mean
Net Monthly Value
+$84,723
Revenue preserved
At τ = 0.42: Caught 349 of 430 churners; 147 false alarm outreaches.
Model: XGBoost + Isotonic CalibratedCV

01 // SYSTEM OVERVIEW

This platform simulates network packet flows and applies Shannon entropy statistical analysis to identify anomalous traffic patterns indicative of Distributed Denial of Service (DDoS) attacks. When an attack occurs, packet header entropy drops sharply as traffic collapses toward targeted ports or IP addresses, enabling instantaneous detection.

02 // THE PROBLEM & ENGINEERING SIGNIFICANCE

The Core Challenge

DDoS attacks saturate network infrastructure by overwhelming target resources. Traditional threshold-based rate limiting triggers false positives during legitimate traffic surges.

Why This Matters

Entropy-based detection detects the structural concentration of traffic regardless of total volume, identifying stealthy low-rate attacks as well as volumetric floods.

Key Constraints:
  • •Calculating running statistical entropy over sliding packet windows with sub-millisecond overhead.
  • •Distinguishing between flash crowds (legitimate diverse users) and distributed botnet attacks.
  • •Providing clear visual telemetry for security analysts to observe entropy state transitions.

03 // DATA PIPELINE & PREPROCESSING

Input Format: Simulated and captured network packet flow headers (Source IP, Destination IP, Port, Protocol, Timestamp)Sample Volume: Simulated traffic streams with configurable attack vectors (SYN floods, UDP storms, HTTP GET floods)
Transformation Steps:
  • Sliding window packet buffer aggregation (W = 100 packets)
  • Probability mass distribution calculation across destination port and IP dimensions
  • Normalized Shannon entropy score computation: H(X) = -sum(p(x) * log2(p(x))) / log2(N)
Cleaning Strategy: Real-time window eviction to maintain constant memory bounds.

04 // SYSTEM ARCHITECTURE & DATA FLOW

Traffic Generator Engine -> Sliding Window Packet Buffer -> Shannon Entropy Calculator -> Anomaly Classification Engine -> Express REST/SSE API -> React Chart.js UI.

STEP 01Node.js Engine
Traffic Generator

Simulates realistic background traffic and triggers randomized DDoS attack scenarios.

STEP 02Information Theory
Entropy Calculator

Computes statistical entropy across sliding windows to detect traffic distribution collapse.

STEP 03Statistical Heuristics
Anomaly Classifier

Compares current entropy to dynamic adaptive baseline thresholds to flag attacks.

STEP 04React · Chart.js
Interactive UI

React dashboard with Chart.js displaying live entropy curves and packet volume.

05 // MODEL ENGINEERING & HYPERPARAMETERS

Base Architecture: Shannon Information Entropy Statistical Anomaly Detector

Baseline entropy calibrated on normal network traffic profiles across 10,000 packet samples.

Hyperparameters & Training Dynamics:
  • • Window Size: 100 packets
  • • Entropy Collapse Threshold: 0.42
  • • Smoothing Alpha: 0.15
Loss Function: N/A (Statistical Metric)
Trade-off Rationale: Small window size yields faster detection (< 50 packets) but higher variance; 100-packet window provided optimal stability.

06 // FAILURE ANALYSIS & ZERO-TRUST SAFEGUARDS

OBSERVED FAILURE MODES UNDER STRESS
  • • Distributed attacks with randomized destination ports designed to mimic normal entropy.
  • • Very low-volume attacks below the window statistical significance threshold.
Mitigation & Fallback: Combined multi-dimensional entropy: joint evaluation of Source IP dispersion and Destination Port concentration.

07 // PRODUCTION DEPLOYMENT SPECS

Serving Framework
Node.js Express Server
Containerization
Docker container with modular client and server builds
P95 SLA
< 2.1ms per window evaluation
Throughput
12,000 packets/sec simulated throughput

08 // ARCHITECTURAL DECISIONS & TRADE-OFFS

Adopted normalized Shannon entropy rather than raw packet counts.
Why: Normalized entropy is scale-invariant: it detects structural traffic anomalies even during low-volume attacks that bypass volumetric firewalls.
Alternative Discarded: Simple requests-per-second thresholding.
Built live interactive visualization using Chart.js.
Why: Allows security engineers and students to clearly observe the mathematical relationship between packet uniformity and entropy collapse.
Alternative Discarded: Headless CLI script.

09 // PLANNED IMPROVEMENTS & NEXT REVISIONS

  • →Incorporate Renyi entropy to allow parameter tuning for heavy-tailed traffic distributions.
  • →Integrate with eBPF / XDP for kernel-level line-rate packet drops upon attack confirmation.
BACK TO ALL PROJECTS
INSPECT ON GITHUB