A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System

doi:10.7652/xjtuxb201302003

您当前的位置：

首页 >

文章列表页 >

A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System

更新时间：2025-07-09

- A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System
- Vol. 47, Issue 2, Pages: 14-19+46(2013)
- 作者机构：
  
  西安交通大学电子与信息工程学院,西安,710049
- 作者简介：
- 基金信息：
- DOI：10.7652/xjtuxb201302003
  CLC： TP393
- Online First：10 February 2013，
  
  Published：2013
- 稿件说明：
移动端阅览
A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System[J]. 2013, 47(2): 14-19+46.
DOI：

A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System[J]. 2013, 47(2): 14-19+46. DOI： 10.7652/xjtuxb201302003.

摘要

针对传统入侵检测系统报警事件数量多、误报率高的问题

提出了一种基于信息熵的网络攻击检测方法。该方法利用雷尼熵对报警事件源IP地址、目标IP地址、源威胁度、目标威胁度以及数据报大小这5个属性香农熵的融合结果来表示网络状态

通过与正常网络状态的对比识别网络异常。真实攻击和人工合成攻击环境中的实验结果表明

该方法能在保持误报率低于1%的情况下命中率高于90%; 与基于特征香农熵的攻击检测方法相比

该方法对攻击更敏感

最易检测出DoS攻击和主机入侵

其次是主机扫描和端口扫描

对蠕虫攻击的检测敏感度稍差。对比测试结果表明

该方法在提高命中率的同时

还能有效降低误报率。

Abstract

A method to detect network attacks using entropy is proposed to solve the problem that the existing intrusion detection system(IDS)typically generates large amounts of alerts with high false rate. Rainey cross entropy is employed to fuse the Shannon entropy vector for five properties of alerts. These five properties are source IP address

destination IP address

source threat

target threat and datagram length. Then the fusing result is used to describe the network state

and is compared with the normal network state to identify the anomalies. The experimental results on actual network attacks data and synthetic attacks show that the proposed approach can detect network attacks with a hit rate more than 90% whereas the false rate is less 1%. Comparisons with the attack detection method based on the characteristics of the Shannon entropy show that the proposed method is more sensitive to attacks

and is easier to detect in the order Denial of Service(DoS)and hosts intrude attacks

and then the hosts scan and port scan attacks

however

is relatively difficult to worm attacks. The test results also show that the proposed method is better than the compared systems with higher hit rate and lower false positives.

关键词

Keywords

references

SCARFONE K, MELL P. Guide to intrusion detection and prevention systems [M]. Gaithersburg, MD, USA: NIST Special Publication, 2007: 9.

TJHAI G, PAPADAKI M, FURNELL S, et al. The problem of false alarms: evaluation with snort and DARPA 1999 dataset [C]∥Proceedings of 5th International Conference on Trust, Privacy and Security in Digital Business. Berlin, Germany: Springer-Verlag, 2008: 139-150.

ABIMBOLA A A, MUNOZ J M, BUCHANAN W J. Investigating false positive reduction in http via procedure analysis [C]∥Proceeding of the International Conference on Networking and Services. Los Alamitos, CA, USA: IEEE Computer Society, 2006: 87-93.

TIAN Zhihong, ZHANG Weizhe, YE Jianwei, et al. Reduction of false positives in intrusion detection via adaptive alert classifier [C]∥International Conference on Information and Automation. Piscataway, NJ USA: IEEE, 2008: 1599-1602.

ALSHAMMARI R, SONAMTHIANG S, TEIMOURI M, et al. Using neuro-fuzzy approach to reduce false positive alerts [C]∥Proceeding of the Fifth Annual Conference on Communication Networks and Services Research. Los Alamitos, CA, USA: IEEE Computer Society, 2007: 345-349.

SPATHOULAS G P, KATSIKAS S K. Reducing false positives in intrusion detection systems [J]. Computers Security, 2010, 29(1): 35-44

郭振滨, 裘正定. 应用高速网络的基于报文采样和应用签名的BitTorrent流量识别算法 [J]. 计算机研究与发展, 2008, 45(2): 227-236.

GUO Zhenbing, QIU Zhengding. Identification of BitTorrent traffic for high speed network using packet sampling and application signatures [J]. Journal of Computer Research and Development, 2008, 45(2): 227-236.

牛国林, 管晓宏, 龙毅, 等, 多源流量特征分析方法及其在异常检测中的应用 [J]. 解放军理工大学学报, 2009, 10(4): 350-355.

NIU Guolin, GUAN Xiaohong, LONG Yi, et al, Analysis method of multi-source flow characteristics and its application in anomaly detection [J]. Journal of PLA University of Science and Technology: Nature Science Edition, 2009, 10(4): 350-355.

NYCHIS G, SEKAR V, ANDERSEN D G, et al. An empirical evaluation of entropy-based traffic anomaly detection [C]∥Proceedings of the 8th ACM SIGCOMM Internet Measurement Conference. New York, USA: ACM, 2008: 151-156.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Point Cloud Simplification Algorithm Based on Improved Bald Eagle Search and K-Means Clustering Iteration

Electrothermal Coupling Research on the Evolutionary Law of Anti-Corona Performance for High-Altitude Air-Cooled Generators

Effects of Steam Addition on the Swirl Combustion and Emission Characteristics of Cracked Ammonia

A Fast Calculation Method for Thermal Flow Fields in Transformer Windings Based on PI-DeepONet

A Structure-Semantics-Residual Collaborative Image Compression Framework：Towards Privacy Protection and High-Fidelity Reconstruction

Related Author

NIU Hongxia

LI Fuli

Related Institution

School of Automation and Electrical Engineering, Lanzhou Jiaotong University

Key Laboratory of Plateau Traffic Information Engineering and Control of Gansu Province, Lanzhou Jiaotong University

Key Lab of Opt-Electronic Technology and Intelligent Control of Ministry of Education,Lanzhou Jiaotong University

⁰