The Prediction and Description Method of IP Network Abnormity Based on the Conditional Entropy
Zeng Jing-jie · Microcomputer Information · 2010
With the evolution update of the intrusion technology of IP network, the traditional IDS faces with enormous challenges. A method to predict and describe abnormity in IP network, based on the Conditional Information Entropy (CIE), is proposed in this paper. It makes up the deficiencies of detection by adopting prediction in advance. This method consists of three parts the processing of network performance raw data, the processing of network alarm information and the quantification based on CIE. The core node collects network performance raw data. The weighted sum of data is graded by Clustering Algorithm. At the same time, IDS alarm information is polymerized in Alert Correlation way and then graded also. Finally the formulae of CIE will be used to evaluate the relationship among those grades. According to the deduction, we can draw the conclusions as follows: the lower CIE, the higher the possibility of intrusion. If CIE is lower than the threshold, warn and trigger the Intrusion Tolerance Mechanism (ITM) of the system.