Multi-Level Distributional Entropy from Flow Summary Statistics for Explainable Network Intrusion Detection
Multi-Level Distributional Entropy (MDE) creates interpretable features from network flow statistics without needing raw packet data. It uses three levels of entropy—within-flow, crossdirectional, and TCP flag patterns—to expose hidden failure modes in intrusion detection systems that aggregate scores often miss.