Network abnormality detection method and system based on information entropy and sliding window

Abstract

The invention discloses network abnormality detection method and system based on information entropy and a sliding window. The method comprises the following steps: defining the size of a time window and a sliding distance of the time window; progressively calculating the entropy and the entropy ratio of each time window orderly according to the sliding window; judging that network abnormality occurs when data mutation is generated in the time window or does not accord with the previous law if the entropy of the time window is smaller than a given threshold or the entropy ratio is greater than the given threshold. By adopting the method and the system, an information entropy model and a sliding window technology are led in, so as to find out the problem of network abnormality; the network abnormity can be quickly found out, the model is simplified to a certain extent, and the network abnormality can be quickly found out.

Description

technical field [0001] The invention relates to a network anomaly detection method and system, in particular to a network anomaly detection method and system based on information entropy and a sliding window. Background technique [0002] The current network anomaly detection methods are mainly based on statistical methods, which mainly include the following five types: 1) Threshold detection technology. For example, detecting the number of times a password is incorrectly used within a short period of time. 2) Mean and standard deviation modeling technique. By calculating the mean and standard deviation of the parameters, a confidence interval is set, and when the observed value exceeds the range of the confidence interval, it indicates that there may be anomalies. 3) Build a multivariate model. Its detection is based on the correlation analysis of two or more parameters to find anomalies. 4) Markov model. Each different type of audit event is regarded as a state variab...

AI Technical Summary

Problems solved by technology

[0003] However, the above-mentioned network anomaly detection methods all have the following disadvantages: the model of the first method is relatively simple, but it cannot detect more abnormal behavior types; for the second method, since the confidence interval needs to be artificially set through experience, it is necessary to A large number of failures and experience to generate a credible confidence interval; the third method has a complex model, and the results will vary greatly with different parameters; the fourth method is suitable for the case where the variable is a continuous parameter, Effective results cannot be obtained for the case of discrete value sampling; the result of the fifth method depends on the size of the time window setting

Images