Classification of Network Traffic and Anomaly Detection Using Entropy in NetFlow Records

Within the field of machine learning and classification techniques, entropy represents a concept with great potential, especially within algorithms like Random Forest. The paper proposes a method for calculating the Shannon entropy of all features within individual NetFlow records in the dataset. By comparing four variations of the LUFlow dataset with and without the entropy feature, the obtained results of the AUC metric and confusion matrix showed improved classification performance using the proposed method for calculating the entropy of NetFlow record features. The suggested approach for calculating the entropy feature demonstrates a greater impact than the entropy feature included in the original LUFlow dataset.