A New Attack Detection in Large Scale Network based on Entropy

Abstract

<p class="Abstract" style="margin: 0cm 0cm 0pt 0.05pt; text-indent: -0.05pt; layout-grid-mode: char;"><span style="font-size: x-small;"><span style="font-family: Times New Roman;"><span style="color: black; font-weight: normal; mso-bidi-font-size: 9.0pt;">Intrusion Detection System (IDS) typically generates </span><span style="color: black; font-weight: normal; mso-fareast-language: ZH-CN; mso-bidi-font-size: 9.0pt;">a huge number</span><span style="color: black; font-weight: normal; mso-bidi-font-size: 9.0pt;"> of alerts with high false rate</span><span style="color: black; font-weight: normal; mso-fareast-language: ZH-CN; mso-bidi-font-size: 9.0pt;">, especially in the large scale network,</span><span style="color: black; font-weight: normal; mso-bidi-font-size: 9.0pt;"> which result in a huge challenge on the efficiency and accuracy of </span><span style="color: black; font-weight: normal; mso-fareast-language: ZH-CN; mso-bidi-font-size: 9.0pt;">the network attack detection</span><span style="color: black; font-weight: normal; mso-bidi-font-size: 9.0pt;">. </span><span style="color: black; font-weight: normal; mso-fareast-language: ZH-CN; mso-bidi-font-size: 9.0pt;">In this paper, an entropy-based method is proposed to analyze the numerous IDS alerts and detect real network attacks. We use Shannon entropy to examine the distribution of the source IP address, destination IP address, source threat and destination threat and datagram length of IDS alerts; employ Renyi cross entropy to fuse the Shannon entropy vector to detect network attack. In the experiment, we deploy the Snort to monitor part of Xi&rsquo;an Jiaotong University (XJTU) campus network including 32 C-class network (more than 4000 users), and gather more than 40,000 alerts per hour on average. The entropy-based method is employed to analyze those alerts and detect network attacks. The experiment result shows that our method can detect 96% attacks with very low false alert rate.</span></span></span></p

SIP Flooding Attacks Detection and Prevention Using Shannon, Renyi and Tsallis Entropy

“…The results show, despite a higher rate of false alarm messages, HD can detect Flooding attacks faster while the Chi-square can show these attacks more clearly (with greater changes in values before and after the attack). In 2012, the authors of [15] presented an entropy-based method to detect the attacks of unauthorized entry in to network and analyze an IDS alarm message. The authors of this paper achieved their goal by Shannon entropy which is calculated based on five features.…”

The Discretization Algorithm for Rough Data and Its Application to Intrusion Detection

“…where ( , ) i p D S is the ratio between the number of the samples which classification attribute value is equal to i D and the total number of the samples in S [14,15].…”

Improving the results of intrusion detection systems

“…Specifically the authors in [70] have collected traffic in the ETH campus and their alert rate was 3 million alerts per day. In [71] experiments have been conducted in the campus network of the Xian Jiaotong University. The alerts collected were 1 million per day.…”

“…Reference Rate mentioned Rate (alerts/sec) [70] 3M / day 34 [71] 1M / day 11 [72] 15 M /day 170 [74] 117 M / month 45…”