Chi-square Distance在协议异常检测中的应用  

Application of Chi-Square Distance to Protocol Anomaly Detection

作　　者：秦拯[1] 李娜[1] 张大方[1] 邹建军[1] 

机构地区：[1]湖南大学软件学院,湖南长沙410082

出　　处：《湖南大学学报（自然科学版）》2005年第4期99-103,共5页Journal of Hunan University:Natural Sciences

基　　金：国家自然科学基金资助项目(60273070);湖南省科技攻关项目(04GK3022);东莞市科研发展基金资助项目(2004018)

摘　　要：针对JuanM提出的一种基于马尔可夫链的随机协议异常检测模型和评估方法存在的不足进行改进.改进后的模型增加了一些必要的状态,初始概率和转换概率更加精确.实验表明,将Chi-SquareDistance和马尔可夫链方法相结合来检测协议异常,可克服原方法的不足,能有效检测到SYNFlooding攻击.We made some improvements on the stochastic protocol model presented by Juan M, which was based on Markov Chain. Some necessary states were added to the modified protocol model to make its initial and transition probabilities more precise. Moreover, we combined Chi-Square Distance into Markov Chain method in order to detect the protocol anomaly. The experimental results show that the modified model can efficiently detect SYN Flooding attacks, thus overcoming the shortage of the previous model.

关 键 词：入侵检测 协议异常检测 马尔可夫链 马尔可夫过程 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]