基于字节频度的异常入侵检测影响因素研究  

Study of Anomaly Intrusion Detection Influencing Factors Based on Byte Frequency

作　　者：翁广安[1] 余胜生[2] 周敬利[2] 

机构地区：[1]华中科技大学文华学院计算机系,武汉430074 [2]华中科技大学计算机学院,武汉430074

出　　处：《计算机工程》2012年第14期119-121,127,共4页Computer Engineering

基　　金：华中科技大学文华学院自然科学基金资助项目"具有自适应能力的免疫入侵检测方法研究"(j02005302)

摘　　要：目前数据包负载异常检测缺乏针对性的测试数据。为此,构建一个模拟网络数据集,对基于字节频度分布的异常检测模型进行测试分析。实验结果表明,该数据集对模型测试具有可行性;数据包大小的分布特性对检测准确度有较大影响,必须根据特定网络服务数据包尺寸的密集分布区确定检测阈值,并尽量向小尺寸方向校准;数据包之间的频度差异对分组求频度平均值的模型有很大影响,组内数据包之间过大的频度差异将导致包模型失效,连接模型性能降低较大,改进的包模型则不受影响。There are not yet competent test datasets for payload based anomaly intrusion detection system. This paper constructs a simulation network dataset to test and analyze anomaly intrusion detection models based on byte frequency. Experimental results indicate that the simulation dataset is valid for those models. Characteristics of packet size distribution imposes important effects on detection accuracy, and system needs to identify the main size range of packets to set a suitable detection threshold, giving higher priority to the smaller packets as soon as possible. Byte frequency differences between packets influence greatly those models calculating average frequency of grouped packets, these large differences may lead to the failure of packet-based model, and result in connection-based model lost much more performances. The modified packet-based model is not influenced by packet frequency differences.

关 键 词：字节频度分布 n—gram序列 负载异常检测 数据包负载 网络入侵检测系统 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]