The Application of Information-Theoretic Measures to Anomaly Detection
Pla Information · Computer Engineering and Applications Journal · 2003
Anomaly detection is an effective protection mechanisms against novel attacks.But most current anomaly detection techniques build model through expensive trial-and-error practice where there is no theoretical guideline.This paper proposes a theoretic base as the guideline for the anomaly detection and introduces several information-theoretic measures,including entropy,conditional entropy,relative conditional entropy and information gain.These measures can be used to guide the model building process and to explain the performance of the model.The paper also explains the feasibility and necessity of this theory through examples.