摘要
随着人们对网络流量特征研究的深入,网络异常检测技术得以不断发展,因此流量特征分析是网络异常检测的基础性重要工作。文章研究基于熵的流量信息结构特征,不同于已有的网络流量初级统计特征研究,它以提取的流量属性在单位时间内分布特征为研究对象。基于DARPA 99数据集的实验表明,该方法相对于基于流量初级统计特征方流量异常表示方法具有更强的敏感性。
Because of the deep research of network traffic feature, technique of network anomaly detection developed rapidly. So the analysis of network traffic becomes a primary important basement of network anomaly detection. This paper study the traffic distribution feature based on entropy, different from traffic research based on the primary statistical feature, the study object becomes extracted attribute distribution feature. Experiment based on DARPA 99 dataset shows that, compared with proposed method, this kind of means is much more sensitive to anomaly traffic.
出处
《信息网络安全》
2014年第3期28-31,共4页
Netinfo Security
基金
全军军事学研究生课题[2011JY002-435]
关键词
网络流量异常
网络流量特征
流量信息结构
信息熵
network traffic anomaly
feature of network traffic
traffic information structure
information entropy