Intrusion detection method based on crude entropy property reduction

Abstract

The invention discloses an intrusion detection method based on crude entropy property reduction. The method comprises the following steps of: (1) training: collecting a system calling sequence of a known type process for serving as a training set, counting the occurrence rate of system calling in a certain type of process in the training set, performing normalization processing on the sequence to generate a short sequence set, calculating the property importance of short sequences on the basis of a property important model, sequencing, training a certain type of process classifying rule on the basis of a crude entropy property reduction algorithm, repeating b, c and d to obtain the classifying rules of all types of processes in the training set to obtain a process classifying rule set, and ending; and (2) detecting: collecting the system calling sequence of a process to be detected, pre-processing the calling sequence to generate a short sequence set, identifying a process type according to the process classifying rule, judging whether the process is abnormal, and ending. Due to the adoption of the intrusion detection method, the detection accuracy is increased on the premise of ensuring computing easiness, and the false alarm rate is lowered remarkably.

Description

technical field [0001] The invention relates to an intrusion detection method based on host system call sequence analysis, in particular to an intrusion detection method based on rough entropy sequence information system attribute reduction. Background technique [0002] Intrusion detection technology is a new type of network security technology that has emerged in the past 20 years. As an important security guarantee behind the firewall, the intrusion detection system can detect various forms of intrusion, and is an important part of the modern computer network security system. In the environment of rapid development of network technology and increasingly prominent network security issues, traditional intrusion detection systems have been difficult to meet the detection tasks of increasingly complex network attacks. One of the difficulties is that intrusion detection systems are often difficult to quickly analyze and process the collected data. large amount of data. The e...

AI Technical Summary

Problems solved by technology

However, these algorithms do not consider the attribute importance model constructed by using rough entropy, so they cannot meet the real-time and prediction accuracy requirements of the intrusion detection system through attribute reduction.

Images