Information Theory and Data-Mining Techniques for Network Traffic Profiling for Intrusion Detection

• 作者: Joel Ruiz-Ibarra Pablo Velarde-Alvarado Rafael Martinez-Pelaez Victor Morales-Rocha
• 来源期刊: 电脑和通信(英文)
• 学科: 工学
• 关键词: INTRUSION Detection Traffic PROFILING Entropy and Network WORMS
• 年，卷（期）: 2014,（11）
• 页码范围: 24-30
• 页数: 7页
• 分类号: TP39

摘要

In this paper, information theory and data mining techniques to extract knowledge of network traffic behavior for packet-level and flow-level are proposed, which can be applied for traffic profiling in intrusion detection systems. The empirical analysis of our profiles through the rate of remaining features at the packet-level, as well as the three-dimensional spaces of entropy at the flow-level, provide a fast detection of intrusions caused by port scanning and worm attacks.