Entropy Feature Selection of Network Anomaly Detection by Using Mutual Information
YI Sheng-lan · Telecommunication Engineering · 2012
Firstly,the shortcomings of traditional statistical analysis using network flow data are discussed,and it is pointed out that the entropy analysis can reflect more potential information to find out more network anomaly that can not be found by the traditional statistical analysis.Secondly,the difference between the flow entropy and count entropy is discussed and it is proposed that they should be used cooperatively and that using one of them just as existing studies is not recommended.Finally,features of the two kinds of entropy are studied bymutual information analysis.The simulations show that there is redundant in them.After redundant features are eliminated,the detection efficiency is increased significantly while the detection accuracy is maintained.