A Time-Based Hierarchical Detection Method for TCP SYN Flood Attacks Using Self-Information and Three-Way Handshake Analysis

Controlled numerical analyses examine the mathematical relationships among connection-state probability, self-information, and entropy. The results demonstrate the theoretical feasibility and interpretability of the proposed framework. In particular, self-information provides a one-to-one mapping between a nonzero connection-state probability and its information value, whereas different probability distributions may produce identical entropy values. However, these proof-of-concept results do not constitute an operational IDS benchmark or establish detection performance in terms of Accuracy, FPR, FNR, or detection delay. Therefore, validation using labeled public datasets and real network environments is required before the framework can be considered for operational deployment.