作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2012, Vol. 38 ›› Issue (14): 119-121. doi: 10.3969/j.issn.1000-3428.2012.14.035

• 安全技术 • 上一篇    下一篇

基于字节频度的异常入侵检测影响因素研究

翁广安 a,余胜生 b,周敬利 b   

  1. (华中科技大学 a. 文华学院计算机系;b. 计算机学院,武汉 430074)
  • 收稿日期:2011-11-14 出版日期:2012-07-20 发布日期:2012-07-20
  • 作者简介:翁广安(1975-),男,讲师、博士,主研方向:网络与信息安全,云计算;余胜生、周敬利,教授、博士生导师
  • 基金资助:

    华中科技大学文华学院自然科学基金资助项目“具有自适应能力的免疫入侵检测方法研究”(j02005302)

Study of Anomaly Intrusion Detection Influencing Factors Based on Byte Frequency

WENG Guang-an a, YU Sheng-sheng b, ZHOU Jing-li b   

  1. (a. Department of Computer Science, Wenhua School; b. School of Computer, Huazhong University of Science & Technology, Wuhan 430074, China)
  • Received:2011-11-14 Online:2012-07-20 Published:2012-07-20

摘要: 目前数据包负载异常检测缺乏针对性的测试数据。为此,构建一个模拟网络数据集,对基于字节频度分布的异常检测模型进行测试分析。实验结果表明,该数据集对模型测试具有可行性;数据包大小的分布特性对检测准确度有较大影响,必须根据特定网络服务数据包尺寸的密集分布区确定检测阈值,并尽量向小尺寸方向校准;数据包之间的频度差异对分组求频度平均值的模型有很大影响,组内数据包之间过大的频度差异将导致包模型失效,连接模型性能降低较大,改进的包模型则不受影响。

关键词: 字节频度分布, n-gram序列, 负载异常检测, 数据包负载, 网络入侵检测系统

Abstract: There are not yet competent test datasets for payload based anomaly intrusion detection system. This paper constructs a simulation network dataset to test and analyze anomaly intrusion detection models based on byte frequency. Experimental results indicate that the simulation dataset is valid for those models. Characteristics of packet size distribution imposes important effects on detection accuracy, and system needs to identify the main size range of packets to set a suitable detection threshold, giving higher priority to the smaller packets as soon as possible. Byte frequency differences between packets influence greatly those models calculating average frequency of grouped packets, these large differences may lead to the failure of packet-based model, and result in connection-based model lost much more performances. The modified packet-based model is not influenced by packet frequency differences.

Key words: byte frequency distribution, n-gram sequence, payload anomaly detection, packet payload, Network Intrusion Detection System (NIDS)

中图分类号: