Intrusion alarm analyzing method based on relative entropy

Abstract

The invention relates to an intrusion alarm analyzing method based on relative entropy. According to massive alarm flow produced by an intrusion detection system, the macroscopic safety condition of a current network is evaluated and the attack condition on which the most attention should be paid is described. The intrusion alarm analyzing method comprises the steps of obtaining an alarm of the intrusion detection system; building a normal parameter base line with multiple characteristics and a tolerance range according to historical data and expert knowledge; adopting a threshold value detection method based on the relative entropy according to the five characteristics of intrusion alarm data, wherein the five characteristics include a source IP address, a target IP address, a source port, a target port and an alarm type; determining that abnormal flow exists once the alarm flow exceeds the tolerance range of the base line; helping a network manager position a network abnormity rapidly by excavating and analyzing abnormities and effectively recognizing and reporting types of the abnormities.

Description

technical field [0001] The invention relates to an intrusion alarm analysis method based on relative entropy, in particular to a large-scale network-oriented intrusion detection system, which utilizes relative entropy theory to monitor, manage and analyze massive network alarm data in real time. It belongs to the field of information security technology. Background technique [0002] Intrusion Detection System (IDS) detects network traffic in real time, monitors various network behaviors, and timely alarms and protects traffic that violates security policies. It is an effective means to solve computer network security problems. However, the current intrusion detection system has problems such as too much alarm information and a high false alarm rate. A large amount of alarm information is caused by the normal behavior of users in the network. For administrators of large-scale networks, faced with hundreds of millions of alarm traffic, they urgently need intrusion alarm auxi...

AI Technical Summary

Problems solved by technology

In addition, correlation analysis usually defines alarms as the premise or result of multi-step attacks. However, a large number of alarms are caused by the normal operation of the system, which cannot be effectively distinguished only by the alarm itself and alarm evaluation, so it is not suitable for practical engineering applications.

Images