摘要： 异常检测是防范新型攻击的基本手段。该文使用信息熵作为理论工具,用正常行为的熵相对于随机行为的熵的比值作为正常行为规则性的度量标准,并结合一个具体的异常检测实例验证了这种度量标准的合理性。

关键词: 入侵检测, 异常检测, 熵

Abstract: Anomaly detection is an essential component of the protection mechanisms against novel attacks. This paper proposes an entropy-based method to measure the regularity of normal behaviors in anomaly detection. This measure is defined as the ratio of normal behavior's entropy to totally random behavior's entropy. It uses case studies on Unix system call data to illustrate the utilities of this measure.

中图分类号: 

• TP393.08