An Entropy-based Method on Network Attack Detection

摘要：

Intrusion Detection System (IDS) typically generates large amounts of alerts with high false rate. Identifying the network attack from the huge volume of alerts is a frustrating task for security officers. The situation gets worse when a large-scale network is monitored by IDS. In this paper we propose an entropy-based method to detect network attack from millions of alerts. First, the Shannon entropy is used to analyze the distribution characteristics of alert source IP address, destination IP address, source threat, destination threat and datagram length. Then, the Renyi cross entropy is employed to fuse the Shannon entropy vector and detect the anomalies. The IDS used in our experiment is Snort, and the experimental results based on actual network data show that our approach can detect network attack quickly and accurately.

关键词： network securiy IDS shannon entropy renyientropy

作者: Zhiwen Wang Ke Lu Ting Liu

作者单位: MOE Key Lab for Intelligent Networks and Network Security,State Key Lab for Manufacturing Systems School of Electronic and Information Engineering,Xian Jiaotong University Xian,P.R.China

会议类型: 国际会议

会议名称: 2011 3rd International Conference on Computer and Network Technology(ICCNT 2011)(2011第三届IEEE计算机与网络技术国际会议)

会议地点: 太原

会议语种:英文

页码: 485-489

在线出版日期: 2011-02-26（万方平台首次上网日期，不代表论文的发表时间）