一种基于xenVMI机制下的蜜网流量异常检测方法

A honeynet traffic detection method based on xenVMI mechanisms

针对目前私有云网络存在的安全隐患,提出了一种基于xen VMI机制下的蜜网流量异常检测模型。首先通过数据捕获模块截获蜜网流量;然后利用BP神经网络自主性、交互性和主动性的特征,对捕获的流量特征进行训练,得到五元组特征;再计算五元组特征的信息熵,从而判定蜜网中异常行为。实验结果表明,模型可以有效地检测蜜网中的异常,并通过对异常的分析增强私有云网络的防御能力。

This paper proposes a honeynet traffic anomaly detection mechanism based on the xenVMI mechanism aiming at the private cloud network security risks. Firstly, honeynet flow is intercepted by data capture module. Secondly, the autonomy, initiative and interactive features of BP netual networks are used to train the captured flow features. Lastly, quintuple features information en- tropy is gotten to determinate the abnormal behavior existing in honeynet. The proposed scheme proves to be effectively in discovery anomalies in honeynet,and enhance defense capabilities of private cloud network by the anomal of analysis.