Using Cross Entropy to Detect and Classify Network Anomalous Traffic

您当前的位置：

首页 >

文章列表页 >

Using Cross Entropy to Detect and Classify Network Anomalous Traffic

更新时间：2025-07-09

- Using Cross Entropy to Detect and Classify Network Anomalous Traffic
- Vol. 44, Issue 6, Pages: 10-15(2010)
- 作者机构：
  
  1. 西安交通大学电子与信息工程学院,西安,710049
  2. 广东海洋大学信息学院,广东,湛江,524088
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP393
- Online First：10 June 2010，
  
  Published：2010
- 稿件说明：
移动端阅览
Using Cross Entropy to Detect and Classify Network Anomalous Traffic[J]. 2010, 44(6): 10-15.
DOI：

Using Cross Entropy to Detect and Classify Network Anomalous Traffic[J]. 2010, 44(6): 10-15. DOI：

摘要

针对准确识别网络攻击行为的问题

提出了一种基于交叉熵的流量异常检测和分类方法.首先使用流头部特征属性和行为特征属性对DoS攻击、端口扫描和网络扫描等3种常见攻击进行描述

并使用交叉熵来度量各属性上流量的分布变化

建立各攻击的行为特征向量

然后使用指数加权滑动平均控制图方法对多种交叉熵指标进行异常检测得到检测异常向量

最后以检测异常向量和各行为特征向量的相似度来判别攻击类型.针对路由器中Netflow流量的实验结果表明

对于强度较小的攻击

相比香农熵度量法

交叉熵度量法的攻击分类正判率和精确率平均提高了13%和15%

正确率提高了13%.

Abstract

A traffic anomaly detection and classification method based on cross entropy is proposed to identify network attack behaviors accurately. Both features of traffic flow header and traffic behavior are used to characterize three types of common attacks

such as DoS attacks

port scans and network scans. The cross entropy is used to measure traffic distribution changes for each traffic feature

and a behavior vector for each attack type is built. Then exponentially weighted moving average control chart method is applied to multiple cross entropy indicators for anomaly detection

and an anomaly vector is generated. The similarity between the anomaly vector and each behavior vector is computed to classify attacks. Experimental results and comparisons with the Shannon entropy measurement on Netflow traffic in a router show that under relatively weaker attacks

the true positive rate

average precision and accuracy of the cross entropy measurement in attack classification rise by 13%

15%

and 13%

respectively.

关键词

Keywords

references

陈光英,张千里,李星. 基于SVM分类机的入侵检测系统[J]. 通信学报, 2002, 23(5): 51-56.

CHEN Guangying, ZHANG Qianli, LI Xing. SVM classification-based intrusion detection system[J]. Journal of China Institute of Communications, 2002, 23(5): 51-56.

KRISHAN K, JOSHIL R C, KULDIP S. A distributed approach using entropy to detect DDoS attacks in ISP domain [C]∥Proceedings of International Conference on Signal Processing, Communications and Networking. Piscataway, NJ, USA: IEEE, 2007:331-337.

ANUKOOL L, MARK C, CHRISTOPHE D. Mining Anomalies using traffic feature distributions [C]∥Proceedings of Special Interest Group on Data Communication Conference. New York,USA: ACM, 2005:217-228.

GEORGE N, VYAS S, DAVID G, et al. An empirical evaluation of entropy-based traffic anomaly detection [C]∥Proceedings of Internet Measurement Conference. New York, USA: ACM, 2008:151-156.

QIN Tao, GUAN Xiaohong, LI Wei, et al. Dynamic features measurement and analysis for large-scale networks [C]∥Proceedings of International Conference on Communications. Piscataway, NJ, USA: IEEE, 2008: 212-216.

YAN Ruoyu, ZHENG Qinhua. Using renyi cross entropy to analyze traffic matrix and detect DDoS attacks [J]. Information Technology Journal, 2009, 8(8):1180-1188.

MONTGOMERY D C, MASTRANGELO C M. Some statistical process control methods for autocorrelated data [J]. Journal of Quality Technology, 1991, 23(3): 179-193.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

On-Line Anomaly Detection Method for Network Traffic Based on Adaptive Filtering

A Method for Data Collection and Real-Time Anomaly Detection of Lightweight Hosts

Abnormal Detection and Performance Evaluation of Main Drive Motor of Shield Tunneling Machine Cutter Head

A Fast Calculation Method for Thermal Flow Fields in Transformer Windings Based on PI-DeepONet

A Structure-Semantics-Residual Collaborative Image Compression Framework：Towards Privacy Protection and High-Fidelity Reconstruction

Related Author

郑庆华 1

牛国林 1

张剑 1

童言 1

徐明迪 2

秦涛 3

TANG Yuxiang

TAO Jianfeng

Related Institution

School of nformation Science, Guangdong Ocean University

System Research Department, Wuhan Digital Engineering Institute

School of Mechanical and Power Engineering, Shanghai Jiao Tong University

State Key Laboratory of Mechanical System and Vibration, Shanghai Jiao Tong University

⁰