Network traffic anomaly detection based on relative entropy
Liao Jian-fei · Journal of Nanjing University of Posts and Telecommunications · 2012
The anomaly detection of network traffic,which aims at detecting abrupt attacks timely and accurately,is important in the field of network security.Existing detection methods,such as the methods based on data mining and wavelet analysis,fail to meet the application requirements of online traffic detection either due to the high complexity of algorithm or the poor detection effect.By introducing the concept of information entropy and calculating relative entropy of the network traffic on the vision of the traffic's dimensions and hierarchies in real-time,this paper proposes a relative entropy based detection method with the time complexity of algorithm at O(N×log2N×D).Experiment analysis shows that the false alarm rate can be controlled only in 0.03～0.05 when the detection rate reaches 0.8～0.85,which meets the requirements of real-time and accuracy simultaneously.