基于熵的入侵检测研究综述

在网络安全领域中,用熵值分析网络中的异常流量是一个较为常用的异常入侵检测方法。总结已知入侵检测方法的分类,并给出各种方法的应用场景及优缺点。结合信息熵、相对熵、条件熵、活跃熵等熵值理论在入侵检测领域的研究,概述其研究现状,总结不同的熵值理论的应用场景和不足之处。最后讨论基于熵的入侵检测方法的改进方向。

A REVIEW OF ENTROPY-BASED INTRUSION DETECTION

It is a common method of abnormal intrusion detection to use entropy value to analyze abnormal traffic in the field of network security.The paper summarizes the classification of existing intrusion detection methods,and gives the application scenarios,advantages and disadvantages of various methods.Combining information entropy,relative entropy,conditional entropy,active entropy and other entropy theory in the field of intrusion detection,we provid an overview of the research status,and summarized the application scenarios and shortcomings of different entropy values theories.Finally,we discuss the improvement direction of intrusion detection method based on entropy.