Effect of nonstationarity of network traffic in entropy-based intrusion detection (case study)
Ilija V. Basicevic, Zarko Kostovic, Miroslav V. Popovic, Stanislav Očovaj · 2013
Anomaly-based network intrusion detection that uses entropy has been researched for quite some time. In this paper, we present results of application of an entropy-based anomaly detector, implemented as an extension of snort intrusion detection system. The detector has been realized as a platform for case study on applicability of entropy-based techniques in network intrusion detection. The paper presents results of the detector's application to two available network traces. The analysis of results shows that nonstationarity is an important property of network traffic which has to be taken into account in entropy based intrusion detection.