关键词: 入侵检测, 异常检测, 相对熵理论, 测评数据

Abstract: Low detection rate, high false alarm rate and limited types of attacks which can be detected have become the biggest obstacle to the development of network anomaly detection. In order to improve the detection rate, reduce the false alarm rate and enlarge the area of detected attacks, a new method of network anomaly detection was proposed. Firstly, the network traffic was analyzed and the fullprobability events of measures were characterized by the introduction of relative entropy theory. Secondly, the weighted relative entropy was got by integrating relative entropy of multiple measures with weighted coefficients. Lastly, the standard to judge network anomaly finally was the comprehensive multimeasure weighted relative entropy. The experimental results on DARPA 1999 intrusion detection evaluation datasets show that the detector has a higher detection rate at lower false alarm rate and the result is better than other methods.

Key words: intrusion detection, anomaly detection, relative entropy theory, evaluation data