Multi-measure network abnormity detection method based on relative entropy theory

Abstract

The invention discloses a multi-measure network abnormity detection method based on a relative entropy theory. In the detection method, an integrative relative entropy is obtained by weighting the relative entropy of a plurality of measures to judge network abnormity, thereby avoiding the problem of single-point malfunction of single-measure detection under a certain specific attack; simultaneously, abnormity detection based on the relative entropy is different from the abnormity detection of the flow rate, and the abnormity of the measures can be accurately reflected. The method is concretelyactualized according to the following steps: step 1, selecting and quantifying the measures for abnormity detection; step 2, preprocessing data; step 3, training a sample; step 4, detecting the single-measure relative entropy; step 5, calculating the multi-measure weighting relative entropy; and step 6, displaying an alarm mechanism and a detection result. The technical scheme provided by the method is beneficial to solving the problems of insufficient attack detection range and contravention between the detection rate and the misinformation lowering rate existing in the prior network abnormity detection technique and can provide various network environments, such as a host machine, a local area network, a wide area network and the like, to carry out network circuit abnormity detection.

Description

technical field [0001] The invention belongs to the technical field of information security, and relates to a method for detecting network anomalies, in particular to a multi-measure network anomaly detection method based on relative entropy theory. Background technique [0002] While computer networks bring convenience to people, they often face various security threats, such as computer viruses, Trojan horses, network monitoring, hacker attacks, and malicious software including rogue software, etc. These malicious attacks on the network A direct consequence of this is causing various anomalies in network usage. Network anomaly detection can enable people to discover network attacks early and take corresponding countermeasures to curb the further development of network anomalies. [0003] The research on network anomaly detection methods has been published since the first network intrusion detection system NSM in 1990. The proposed methods include probability statistics an...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a multi-measure network anomaly detection method based on relative entropy theory, which helps to solve two thorny problems that have been faced in the existing network anomaly detection: one is that the detection range of attacks is not comprehensive enough; The tension between detection rate and false positive rate reduction

Images