基于信息熵的数据流加密判断算法  

Detection of Encrypted Data-Flow Based on Entropy

作　　者：张玉冲[1] 王松杰[1] 李洋[1] 

机构地区：[1]中国空空导弹研究院,洛阳471001

出　　处：《计算机与数字工程》2014年第4期555-558,共4页Computer & Digital Engineering

摘　　要：针对基于数据流检测木马检测系统的实际需要,提出一种基于信息熵的数据流加密判断算法,引入N-截断熵的概念用于置信区间的计算,并通过仿真建立了可靠的置信区间。该算法通过检测一条数据流的一个数据包,就可以判断整条数据流是否加密,有非常好的效率,可以达到实时在线判断,通过实验验证,算法具有很高的准确率和很低的误报率,算法已应用于基于数据流检测的木马检测系统,完全达到系统要求。According to the requirement of the Trojan detection system based on dataflow checking, an algorithm for detecting encrypted data-flow is proposed in this text. The N-truncated entropy is introduced to compute confidence interval, and the reliable confidence interval is computed. This algorithm can efficiently check a data flow whether it is encrypted through checking one data. By experimental verification, the algorithm has high accuracy and low rate of false positives. This algorithm had been applied in Trojan detection system based on network traffic checking.

关 键 词：数据流 加密判断 信息熵 N-截断熵 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]