入侵检测系统利用信息熵检测网络攻击的方法

夏秦; 王志文; 卢柯

doi:10.7652/xjtuxb201302003

您当前的位置：

首页 >

文章列表页 >

入侵检测系统利用信息熵检测网络攻击的方法

更新时间：2025-07-09

- 入侵检测系统利用信息熵检测网络攻击的方法
- A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System
- 西安交通大学学报 2013年47卷第2期页码：14-19+46
- 作者机构：
  
  西安交通大学电子与信息工程学院,西安,710049
- 作者简介：
- 基金信息：
  
  : 2012-04-09。作者简介: 夏秦(1973—),女,博士,讲师。基金项目: 国家自然科学基金资助项目(60970121)
- DOI：10.7652/xjtuxb201302003
  中图分类号： TP393
- 网络首发：2013-02-10，
  
  纸质出版：2013
- 稿件说明：
移动端阅览
夏秦, 王志文, 卢柯. 入侵检测系统利用信息熵检测网络攻击的方法[J]. 西安交通大学学报, 2013,47(2):14-19+46.

A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System[J]. 2013, 47(2): 14-19+46.
夏秦, 王志文, 卢柯. 入侵检测系统利用信息熵检测网络攻击的方法[J]. 西安交通大学学报, 2013,47(2):14-19+46. DOI： 10.7652/xjtuxb201302003.

A Method to Detect Network Attacks Using Entropy in the Intrusion Detection System[J]. 2013, 47(2): 14-19+46. DOI： 10.7652/xjtuxb201302003.

摘要

针对传统入侵检测系统报警事件数量多、误报率高的问题

提出了一种基于信息熵的网络攻击检测方法。该方法利用雷尼熵对报警事件源IP地址、目标IP地址、源威胁度、目标威胁度以及数据报大小这5个属性香农熵的融合结果来表示网络状态

通过与正常网络状态的对比识别网络异常。真实攻击和人工合成攻击环境中的实验结果表明

该方法能在保持误报率低于1%的情况下命中率高于90%; 与基于特征香农熵的攻击检测方法相比

该方法对攻击更敏感

最易检测出DoS攻击和主机入侵

其次是主机扫描和端口扫描

对蠕虫攻击的检测敏感度稍差。对比测试结果表明

该方法在提高命中率的同时

还能有效降低误报率。

Abstract

A method to detect network attacks using entropy is proposed to solve the problem that the existing intrusion detection system(IDS)typically generates large amounts of alerts with high false rate. Rainey cross entropy is employed to fuse the Shannon entropy vector for five properties of alerts. These five properties are source IP address

destination IP address

source threat

target threat and datagram length. Then the fusing result is used to describe the network state

and is compared with the normal network state to identify the anomalies. The experimental results on actual network attacks data and synthetic attacks show that the proposed approach can detect network attacks with a hit rate more than 90% whereas the false rate is less 1%. Comparisons with the attack detection method based on the characteristics of the Shannon entropy show that the proposed method is more sensitive to attacks

and is easier to detect in the order Denial of Service(DoS)and hosts intrude attacks

and then the hosts scan and port scan attacks

however

is relatively difficult to worm attacks. The test results also show that the proposed method is better than the compared systems with higher hit rate and lower false positives.

关键词

Keywords

references

SCARFONE K, MELL P. Guide to intrusion detection and prevention systems [M]. Gaithersburg, MD, USA: NIST Special Publication, 2007: 9.

TJHAI G, PAPADAKI M, FURNELL S, et al. The problem of false alarms: evaluation with snort and DARPA 1999 dataset [C]∥Proceedings of 5th International Conference on Trust, Privacy and Security in Digital Business. Berlin, Germany: Springer-Verlag, 2008: 139-150.

ABIMBOLA A A, MUNOZ J M, BUCHANAN W J. Investigating false positive reduction in http via procedure analysis [C]∥Proceeding of the International Conference on Networking and Services. Los Alamitos, CA, USA: IEEE Computer Society, 2006: 87-93.

TIAN Zhihong, ZHANG Weizhe, YE Jianwei, et al. Reduction of false positives in intrusion detection via adaptive alert classifier [C]∥International Conference on Information and Automation. Piscataway, NJ USA: IEEE, 2008: 1599-1602.

ALSHAMMARI R, SONAMTHIANG S, TEIMOURI M, et al. Using neuro-fuzzy approach to reduce false positive alerts [C]∥Proceeding of the Fifth Annual Conference on Communication Networks and Services Research. Los Alamitos, CA, USA: IEEE Computer Society, 2007: 345-349.

SPATHOULAS G P, KATSIKAS S K. Reducing false positives in intrusion detection systems [J]. Computers Security, 2010, 29(1): 35-44

郭振滨, 裘正定. 应用高速网络的基于报文采样和应用签名的BitTorrent流量识别算法 [J]. 计算机研究与发展, 2008, 45(2): 227-236.

GUO Zhenbing, QIU Zhengding. Identification of BitTorrent traffic for high speed network using packet sampling and application signatures [J]. Journal of Computer Research and Development, 2008, 45(2): 227-236.

牛国林, 管晓宏, 龙毅, 等, 多源流量特征分析方法及其在异常检测中的应用 [J]. 解放军理工大学学报, 2009, 10(4): 350-355.

NIU Guolin, GUAN Xiaohong, LONG Yi, et al, Analysis method of multi-source flow characteristics and its application in anomaly detection [J]. Journal of PLA University of Science and Technology: Nature Science Edition, 2009, 10(4): 350-355.

NYCHIS G, SEKAR V, ANDERSEN D G, et al. An empirical evaluation of entropy-based traffic anomaly detection [C]∥Proceedings of the 8th ACM SIGCOMM Internet Measurement Conference. New York, USA: ACM, 2008: 151-156.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

改进秃鹰搜索和K均值混合迭代的点云简化算法

混合电解槽阵列协同的风光耦合制氢系统双层多目标优化

EBSILON软件在热电联产系统优化中的应用综述

水蒸气掺混对氨裂解气旋流燃烧与排放特性的影响研究

张角凹坑气膜孔对双层壁气膜冷却特性的影响