基于持续增量模型的低速端口扫描检测算法  

Low-speed port scan detection algorithm based on continuous incremental model

作　　者：薛少勃 沈晶[1] 刘海波[1] Xue Shaobo;Shen Jing;Liu Haibo(School of Computer Science&Technology,Harbin Engineering University,Harbin 150001,China)

机构地区：[1]哈尔滨工程大学计算机科学与技术学院,哈尔滨150001

出　　处：《计算机应用研究》2020年第4期1125-1127,1131,共4页Application Research of Computers

基　　金：国家重点研发计划资助项目(2017YFC0820700);黑龙江省自然科学基金资助项目(F2018011);中央高校基本科研业务费专项资金资助项目(HEUCFP201808)。

摘　　要：针对低速端口扫描进行了研究,根据低速扫描的时间持续性和特征分散性,提出了一种基于持续增量模型的低速端口扫描检测算法,结合条件熵对特征分布的评估达到检测目的。实验结果表明,该算法的检测率能达到99.78%,且误报率为7%。其适用于多种复杂网络环境,且不需要网络先验知识,同时检测率对阈值的精确性要求低,能够有效检测到低速端口扫描行为。This paper studied low-speed port scanning.According to the time persistence and feature dispersion of low-speed scanning,it proposed a low-speed port scanning detection algorithm based on continuous incremental model.it used the conditional entropy to evaluate the feature distribution.The experimental results show that the detection rate of the algorithm can reach 99.78%,and the false positive rate is 7%.The algorithm is applicable to a variety of complex network environments,and does not require network prior knowledge.The detection rate has low accuracy on the threshold,and can effectively detect low-speed port scanning behavior.

关 键 词：低速端口扫描 持续增量模型 信息熵 异常检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]