利用互信息进行网络异常检测的熵特征优选

Entropy Feature Selection of Network Anomaly Detection by Using Mutual Information

首先讨论了传统流量统计分析的缺点,指出熵分析能够反映更多潜在的信息,发现传统流量统计分析不能发现的网络异常。其次,讨论了流量熵和计数熵的不同,指出两者应该配合使用,不能如现有研究中一样片面地使用其中一种。最后,用互信息法分析了两种熵的常用特征,实验发现两者分别呈现冗余状态,在剔除冗余之后检测的效率有明显提高,且不失检测准确率。

Firstly, the shortcomings of traditional statistical analysis using network flow data are discussed, and it is pointed out that the entropy analysis can reflect more potential information to find out more network anomaly that can not be found by the traditional statistical analysis. Secondly, the difference between the flow entropy and count entropy is discussed and it is proposed that they should be used cooperatively and that using one of them just as existing studies is not recommended. Finally, features of the two kinds of entropy are studied bymu- tual information analysis. The simulations show that there is redundant in them. After redundant features are e- liminated, the detection efficiency is increased significantly while the detection accuracy is maintained.