Entropy operation-based network intrusion detection method and device

Abstract

The embodiment of the invention discloses an entropy operation-based network intrusion detection method, which comprises the following steps of: capturing a network node data packet, and preprocessing the network node data packet to obtain target data; constructing a relational graph by utilizing the target data; calculating cross entropies of all network nodes; and sorting the cross entropies of all the network nodes, and finding out key network nodes with high activity. The embodiment of the invention also discloses an entropy operation-based network intrusion detection device. According to the entropy operation-based network intrusion detection method and the entropy operation-based network intrusion detection device disclosed by the invention, a network structure is converted into a graph structure, and the influences of the network nodes in the graph structure are found out according to the attributive characters of the network nodes in the graph by utilizing the entropy theory of the graph, and sorting is performed by the influences, and thus, the key network nodes with the highest activity can be easily obtained, and thereby, the information of the network nodes can be conveniently further analyzed so as to determine whether a network intrusion action occurs or not or adopt corresponding measure.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a network intrusion detection method based on entropy calculation. Background technique [0002] With the expansion of the openness, sharing and interconnection of the network, especially the emergence of the Internet, the importance of the network and its influence on society are also increasing. Internet The Internet is an open technology for all users. Resource sharing and information security are a pair of contradictions. While the Internet provides information sharing and brings us great convenience, its own security issues are also becoming increasingly prominent. According to the statistics of the Computer Emergency Response Teen (CERT), the number of security incidents continues to increase with the development of the Internet. Especially in the past two or three years, there has been a sharp upward trend of exponential growth. According to rough stat...

AI Technical Summary

Problems solved by technology

[0013] In view of the increasingly complex network environment and the existing intrusion detection technology with large amount of calculation, complex calculation process

Images