【摘要】 网络流量的异常检测是网络安全领域一个重要分支,目标是及时准确地检测网络中发生的突发攻击事件。现有流量异常检测方法如数据挖掘、小波分析等方法或因检测效果较差,或因算法复杂,难以满足实时在线流量检测的应用需求。文中引入信息熵概念,通过对网络流量进行分维和分层实时计算网络流量相对熵,提出了一种基于相对熵的流量异常检测方法,算法时间复杂度为O(N×log2N×D)。实验分析表明,当检测率达到0.80～0.85时,误报率控制在0.03～0.05,可同时满足系统实时性和准确性要求。更多还原

【Abstract】 The anomaly detection of network traffic,which aims at detecting abrupt attacks timely and accurately,is important in the field of network security.Existing detection methods,such as the methods based on data mining and wavelet analysis,fail to meet the application requirements of online traffic detection either due to the high complexity of algorithm or the poor detection effect.By introducing the concept of information entropy and calculating relative entropy of the network traffic on the vision of the traffic’s dimensions and hierarchies in real-time,this paper proposes a relative entropy based detection method with the time complexity of algorithm at O(N×log2N×D).Experiment analysis shows that the false alarm rate can be controlled only in 0.03～0.05 when the detection rate reaches 0.8～0.85,which meets the requirements of real-time and accuracy simultaneously.更多还原