使用交叉熵检测和分类网络异常流量

颜若愚 1; 2; 郑庆华 1

您当前的位置：

首页 >

文章列表页 >

使用交叉熵检测和分类网络异常流量

更新时间：2025-07-09

- 使用交叉熵检测和分类网络异常流量
- Using Cross Entropy to Detect and Classify Network Anomalous Traffic
- 西安交通大学学报 2010年44卷第6期页码：10-15
- 作者机构：
  
  1. 西安交通大学电子与信息工程学院,西安,710049
  2. 广东海洋大学信息学院,广东,湛江,524088
- 作者简介：
- 基金信息：
  
  : 2009-10-18. 作者简介: 颜若愚(1974-),男,博士生;郑庆华(联系人),男,教授,博士生导师. 基金项目: 国家自然科学基金资助项目(60825202,60803079,60633020);国家高技术研究发展计划资助项目(2008AA01Z131);国家科技支撑计划资助项目(2006BAK11B02,2008BAH26B02,2009BAH51B00);中国科学院复杂系统与智能科学重点实验室开放基金资助项目(20080101)
- DOI：
  中图分类号： TP393
- 网络首发：2010-06-10，
  
  纸质出版：2010
- 稿件说明：
移动端阅览
颜若愚 1, 2, 郑庆华 1. 使用交叉熵检测和分类网络异常流量[J]. 西安交通大学学报, 2010,44(6):10-15.

Using Cross Entropy to Detect and Classify Network Anomalous Traffic[J]. 2010, 44(6): 10-15.
颜若愚 1, 2, 郑庆华 1. 使用交叉熵检测和分类网络异常流量[J]. 西安交通大学学报, 2010,44(6):10-15. DOI：

Using Cross Entropy to Detect and Classify Network Anomalous Traffic[J]. 2010, 44(6): 10-15. DOI：

摘要

针对准确识别网络攻击行为的问题

提出了一种基于交叉熵的流量异常检测和分类方法.首先使用流头部特征属性和行为特征属性对DoS攻击、端口扫描和网络扫描等3种常见攻击进行描述

并使用交叉熵来度量各属性上流量的分布变化

建立各攻击的行为特征向量

然后使用指数加权滑动平均控制图方法对多种交叉熵指标进行异常检测得到检测异常向量

最后以检测异常向量和各行为特征向量的相似度来判别攻击类型.针对路由器中Netflow流量的实验结果表明

对于强度较小的攻击

相比香农熵度量法

交叉熵度量法的攻击分类正判率和精确率平均提高了13%和15%

正确率提高了13%.

Abstract

A traffic anomaly detection and classification method based on cross entropy is proposed to identify network attack behaviors accurately. Both features of traffic flow header and traffic behavior are used to characterize three types of common attacks

such as DoS attacks

port scans and network scans. The cross entropy is used to measure traffic distribution changes for each traffic feature

and a behavior vector for each attack type is built. Then exponentially weighted moving average control chart method is applied to multiple cross entropy indicators for anomaly detection

and an anomaly vector is generated. The similarity between the anomaly vector and each behavior vector is computed to classify attacks. Experimental results and comparisons with the Shannon entropy measurement on Netflow traffic in a router show that under relatively weaker attacks

the true positive rate

average precision and accuracy of the cross entropy measurement in attack classification rise by 13%

15%

and 13%

respectively.

关键词

Keywords

references

陈光英,张千里,李星. 基于SVM分类机的入侵检测系统[J]. 通信学报, 2002, 23(5): 51-56.

CHEN Guangying, ZHANG Qianli, LI Xing. SVM classification-based intrusion detection system[J]. Journal of China Institute of Communications, 2002, 23(5): 51-56.

KRISHAN K, JOSHIL R C, KULDIP S. A distributed approach using entropy to detect DDoS attacks in ISP domain [C]∥Proceedings of International Conference on Signal Processing, Communications and Networking. Piscataway, NJ, USA: IEEE, 2007:331-337.

ANUKOOL L, MARK C, CHRISTOPHE D. Mining Anomalies using traffic feature distributions [C]∥Proceedings of Special Interest Group on Data Communication Conference. New York,USA: ACM, 2005:217-228.

GEORGE N, VYAS S, DAVID G, et al. An empirical evaluation of entropy-based traffic anomaly detection [C]∥Proceedings of Internet Measurement Conference. New York, USA: ACM, 2008:151-156.

QIN Tao, GUAN Xiaohong, LI Wei, et al. Dynamic features measurement and analysis for large-scale networks [C]∥Proceedings of International Conference on Communications. Piscataway, NJ, USA: IEEE, 2008: 212-216.

YAN Ruoyu, ZHENG Qinhua. Using renyi cross entropy to analyze traffic matrix and detect DDoS attacks [J]. Information Technology Journal, 2009, 8(8):1180-1188.

MONTGOMERY D C, MASTRANGELO C M. Some statistical process control methods for autocorrelated data [J]. Journal of Quality Technology, 1991, 23(3): 179-193.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

自适应滤波实时网络流量异常检测方法

轻量级主机数据采集与实时异常事件检测方法研究

盾构机刀盘主驱动电机异常检测与性能评估

采用机器学习的大规模并行程序I/O性能建模与预测方法

多工况下离心压气机叶轮-机匣一体联合设计优化