通信学报 ›› 2013, Vol. 34 ›› Issue (Z2): 51-57.doi: 10.3969/j.issn.1000-436x.2013.Z2.011

• 网络与信息安全 • 上一篇    下一篇

基于活跃熵的网络异常流量检测方法

穆祥昆1,2,王劲松1,2,薛羽丰1,2,黄玮1,2   

  1. 1 天津理工大学 智能计算及软件新技术天津市重点实验室,天津 300384
    2 天津理工大学 计算机视觉与系统省部共建教育部重点实验室,天津 300384
  • 出版日期:2013-12-25 发布日期:2017-06-16
  • 基金资助:
    国家自然科学基金资助项目;滨海新区科技小巨人成长计划基金资助项目

Abnormal network traffic detection approach based on alive entropy

Xiang-kun MU1,2,Jin-song WANG1,2,Yu-feng XUE1,2,Wei HUANG1,2   

  1. 1 Tianjin Key Lab of Intelligent Computing &Novel Software Technology,Tianjin University of Technology,Tianjin 300384,China
    2 Key Laboratory of Computer Vision and System,Ministry of Education,Tianjin University of Technology,Tianjin 300384,China
  • Online:2013-12-25 Published:2017-06-16
  • Supported by:
    The National Natural Science Foundation of China;BinHai New District Little Giant of Science and Technology Project

摘要:

提出了一种基于活跃熵的网络异常流量检测新方法,将受监控的目标网络视为一个整体系统,对进出系统的网络数据流所形成的NetFlow记录进行分析,分别统计二者的活跃度井计算它们的活跃熵。在进行活跃熵的计算时,根据流量大小选择不同的尺度来降低误报率,从而能更有效地检测网络流量中存在的异常。在实际网络环境下的模拟实验结果表明,与传统检测方案相比,基于活跃熵的网络异常流量检测方法能够更有效地检测出具有随机特征的网络异常流量。

关键词: 活跃熵, 网络流量, 异常流量检测, NetFlow分析

Abstract:

A novel alive entropy-based detection approach was proposed,which detects the abnormal network traffic based on the values of alive entropies.The alive entropies calculated based on the NetFlow data coming from the network traffic of input and output of a whole system,which is essentially a monitored network.In order to decrease false positive rate of abnormal network traffic,different scales are selected to compute the values of alive entropies in different sizes of network traffic.With the low false positive rate of abnormal network traffic,the abnormal network traffic can be effectively detected.Experiments carried out on a real campus network were used to evaluate the effectiveness of the proposed approach.A comparative study illustrates that the proposed approach may easily detect the abnormal network traffic with random characteristics in comparison with some “conventional” approaches reported in the literatures.

Key words: alive entropy, network traffic, abnormal traffic detection, NetFlow analysis

[1] 李 洪,杨雁武. 中国电信集团电子运维系统整合研究[J]. 电信科学, 2009, 25(11): 74 -77 .
[2] 周杰,梁笃国. 智能监控在上海世博会中的应用探讨[J]. 电信科学, 2009, 25(11): 78 -81 .
[3] 陈斌,李有明,郭涛,雷鹏,刘小青. 基于子载波配对的多用户协作中继系统资源分配算法[J]. 电信科学, 2014, 30(6): 73 -78 .
[4] 齐 宁,汪斌强,王志明. 可重构服务承载网主动保护算法研究[J]. 通信学报, 2012, 33(8): 21 -179 .
[5] 陈一鸣,陈立南. Jersey的研究和在Web服务中的应用[J]. 通信学报, 2014, 35(Z1): 30 -159 .
[6] 林秋华,党 杰,殷福亮. 盲源分离图像加密的相关运算解密法[J]. 通信学报, 2008, 29(1): 17 -114 .
[7] 冷雪飞,刘建业,熊 智. 基于遗传算法的导航实时图像匹配算法[J]. 通信学报, 2008, 29(2): 3 -21 .
[8] 袁 征. 可证安全的数字水印方案[J]. 通信学报, 2008, 29(9): 13 -96 .
[9] 程莹,张云勇,徐雷,房秉毅. 基于Hadoop及关系型数据库的海量数据分析研究[J]. 电信科学, 2010, 26(11): 47 -50 .
[10] 屈彤,周芸. 从NBA联想到三屏融合和手机电视[J]. 电信科学, 2010, 26(11): 153 -155 .