A Comparative Study of Use of Shannon, Rényi and Tsallis Entropy for Attribute Selecting in Network Intrusion Detection

Lima, Christiane Ferreira Lemos; Assis, Francisco de; Souza, Cleonilson Protásio de

doi:10.1007/978-3-642-32639-4_60

Cited by 19 publications

(18 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Three detectors performed better than the Shannon and the Ubriaco detectors, which showed very similar results. With respect to the FPR, the advantage of the Tsallis and Rényi detectors over the Shannon detector is in accordance with Lima et al 27 and Berezinski et al 31 The receiver operating curves for scenarios 4, 6, and 7 are provided in Figures 3 to 5 be seen that in all three cases, the curve for the Rényi detector is nearest to the lower right corner, which indicates the best performance. Figures 6 and 7 present the dependency of the TPR and FPR on the CUSUM threshold parameter for the tested detectors in scenarios 2 and 3, respectively.…”

Section: Performance Evaluationsupporting

confidence: 83%

See 1 more Smart Citation

Application of entropy formulas in detection of denial‐of‐service attacks

Basicevic

Ocovaj

2019

Int J Communication

View full text Add to dashboard Cite

Summary The paper compares five entropy formulas (Shannon, Tsallis, Rényi, Bhatia‐Singh, and Ubriaco) and their application in the detection of distributed denial‐of‐service (DDoS) attacks. The Shannon formula has been used extensively for this purpose for more than a decade. The use of the Tsallis and Rényi formulas in this context has also been proposed. Bhatia‐Singh entropy is a novel information metric with promising results in initial applications in this area. Ubriaco proposed an entropy function based on the fractional calculus. In this paper, flow size distribution was used as the input for detection. The type of DDoS attack is SYN flood, and simulation was used to obtain the input dataset. The results show that the Rényi and Bhatia‐Singh detectors perform better than the rest. Rényi and Tsallis performed similarly with respect to the true positive rate, but Rényi had a much lower false positive rate. The Bhatia‐Singh detector had the best true positive rate but a higher false positive rate than Rényi. The Ubriaco detector performed similar to the Shannon detector. With respect to detection delay, Tsallis, Ubriaco, and Shannon produced similar results, with a slight advantage associated with the Ubriaco detector, while Rényi and Bhatia‐Singh had a larger detection delay than the former three.

show abstract

Section: Performance Evaluationsupporting

confidence: 83%

“…Ferreira Lima et al used data clustering, applied to KDD Cup 99 dataset . SimpleKMeans and FarthestFirst algorithms were used for data clustering.…”

Section: Related Workmentioning

confidence: 99%

Application of entropy formulas in detection of denial‐of‐service attacks

Basicevic

Ocovaj

2019

Int J Communication

View full text Add to dashboard Cite

show abstract

“…He reported that for scan anomalies α-value around 0.5 is the best choice. A comparative study of the use of the Shannon, Renyi and Tsallis entropy for attribute selecting to obtain an optimal attribute subset, which increases the detection capability of decision tree and k-means classifiers was presented by Lima et al [83]. The experimental results demonstrate that the performance of the models built with smaller subsets of attributes is comparable and sometimes better than that associated with the complete set of attributes for DoS and scan attack categories.…”

Section: Detection Via Feature Distributionssupporting

confidence: 40%

An Entropy-Based Network Anomaly Detection Method

Bereziński

Jasiul

Szpyrka

2015

Entropy

163

View full text Add to dashboard Cite

Data mining is an interdisciplinary subfield of computer science involving methods at the intersection of artificial intelligence, machine learning and statistics. One of the data mining tasks is anomaly detection which is the analysis of large quantities of data to identify items, events or observations which do not conform to an expected pattern. Anomaly detection is applicable in a variety of domains, e.g., fraud detection, fault detection, system health monitoring but this article focuses on application of anomaly detection in the field of network intrusion detection.The main goal of the article is to prove that an entropy-based approach is suitable to detect modern botnet-like malware based on anomalous patterns in network. This aim is achieved by realization of the following points: (i) preparation of a concept of original entropy-based network anomaly detection method, (ii) implementation of the method, (iii) preparation of original dataset, (iv) evaluation of the method.

show abstract

“…Among the various proposals the interesting applications concerned, for instance, the work of [28] where the authors applied both entropies for variable selection in computer networks intrusion detection, analyzing models detection capabilities while providing a set of attributes coming from the network traffic. Their results showed that selecting attributes based on the Rènyi and Tsallis entropies can achieve better results as compared to the Shannon entropy.…”

Section: Classification Trees With Entropy Measuressupporting

confidence: 38%

Entropy Based Trees to Support Decision Making for Customer Churn Management

2016

View full text Add to dashboard Cite

In this work we analyze empirically customer churn problem from a physical point of view to provide objective, data driven and significant answers to support decision making process in business application. In particular, we explore different entropy measures applied to decision trees and assess their performance from the business perspective using set of model quality measures often used in business practice. Additionally, the decision trees are compared with logistic regression and two machine learning methods -neural networks and support vector machines.

show abstract

A Comparative Study of Use of Shannon, Rényi and Tsallis Entropy for Attribute Selecting in Network Intrusion Detection

Cited by 19 publications

References 11 publications

Application of entropy formulas in detection of denial‐of‐service attacks

Application of entropy formulas in detection of denial‐of‐service attacks

An Entropy-Based Network Anomaly Detection Method

Entropy Based Trees to Support Decision Making for Customer Churn Management

Contact Info

Product

Resources

About