Chi-square统计技术在信息系统异常检测中的应用

Application of Chi-square statistic technology in anomaly detection of computer information system

描述了Chi-square统计技术的原理,设计了实现该技术的算法,并用V isual C++6.0编程环境实现。为了验证原理和算法的有效性,对UNIX和W indows XP两个系统中的数据进行了采样实验和比较,结果表明:如果以入侵情节为基本单位,本文算法能有效降低误报率和提高检测率。

Principle of the Chi-square statistic technique was described. The algorithm of Chi-square statistical technique was designed and realized using Visual C^＋ ＋ 6. O. In order to verify the effect of principle and algorithm, experiment and comparison of sample data in UNIX and Windows XP system were presented. The results show that the algorithm of Chi-square technique can reduce false alarm rate and increase detection rate effectively based on intrusion scenarios.