使用交叉熵检测和分类网络异常流量  

Using Cross Entropy to Detect and Classify Network Anomalous Traffic

作　　者：颜若愚[1,2] 郑庆华[1] 

机构地区：[1]西安交通大学电子与信息工程学院,西安710049 [2]广东海洋大学信息学院,广东湛江524088

出　　处：《西安交通大学学报》2010年第6期10-15,共6页Journal of Xi'an Jiaotong University

基　　金：国家自然科学基金资助项目(60825202;60803079;60633020);国家高技术研究发展计划资助项目(2008AA01Z131);国家科技支撑计划资助项目(2006BAK11B02;2008BAH26B02;2009BAH51B00);中国科学院复杂系统与智能科学重点实验室开放基金资助项目(20080101)

摘　　要：针对准确识别网络攻击行为的问题,提出了一种基于交叉熵的流量异常检测和分类方法.首先使用流头部特征属性和行为特征属性对DoS攻击、端口扫描和网络扫描等3种常见攻击进行描述,并使用交叉熵来度量各属性上流量的分布变化,建立各攻击的行为特征向量,然后使用指数加权滑动平均控制图方法对多种交叉熵指标进行异常检测得到检测异常向量,最后以检测异常向量和各行为特征向量的相似度来判别攻击类型.针对路由器中Netflow流量的实验结果表明,对于强度较小的攻击,相比香农熵度量法,交叉熵度量法的攻击分类正判率和精确率平均提高了13%和15%,正确率提高了13%.A traffic anomaly detection and classification method based on cross entropy is proposed to identify network attack behaviors accurately.Both features of traffic flow header and traffic behavior are used to characterize three types of common attacks,such as DoS attacks,port scans and network scans.The cross entropy is used to measure traffic distribution changes for each traffic feature,and a behavior vector for each attack type is built.Then exponentially weighted moving average control chart method is applied to multiple cross entropy indicators for anomaly detection,and an anomaly vector is generated.The similarity between the anomaly vector and each behavior vector is computed to classify attacks.Experimental results and comparisons with the Shannon entropy measurement on Netflow traffic in a router show that under relatively weaker attacks,the true positive rate,average precision and accuracy of the cross entropy measurement in attack classification rise by 13%,15%,and 13%,respectively.

关 键 词：交叉熵 异常检测 指数加权滑动平均 攻击分类 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]