Learning Entropy

Abstract

Abstract. Entropy has been widely used for anomaly detection in various disciplines. One such is in network attack detection, where its role is to detect significant changes in underlying distribution shape due to anomalous behaviour such as attacks. In this paper, we point out that entropy has significant blind spots, which can be made use by adversaries to evade detection. To illustrate the potential pitfalls, we give an in-principle analysis of network attack detection, in which we design a camouflage technique and show analytically that it can perfectly mask attacks from entropy based detector with low costs in terms of the volume of traffic brought in for camouflage. Finally, we illustrate and apply our technique to both synthetic distributions and ones taken from real traffic traces, and show how attacks undermine the detector.

An information-theoretic method for the detection of anomalies in network traffic

“…It is worth mentioning that some general weaknesses of entropy-based approaches are highlighted in [16], [17], where "optimal camouflage" strategies are described. In our case, the combined effect of random aggregation and different kinds of entropy adds robustness to the method.…”

“…Indeed the sketch dimensions do not depend on the quantity of processed traffic. Second, as described in [16], [17], entropy does not always allow us to discriminate two (also very different) histograms (as an example, think of two histograms that are scrambled versions of the same histogram). Hence, an attacker could realise a "mimicry" attack, in which after having estimated the traffic distribution, it creates an attack such that the associated histogram, yet very different from the reference one, leads to the same (or very similar) entropy value (as discussed in [17]).…”

Partial Discharge Fault Diagnosis Based on Multi-Scale Dispersion Entropy and a Hypersphere Multiclass Support Vector Machine

“…In order to quantify the PD feature information extracted by VMD, entropy theory is introduced. Entropy, as a measure of uncertainty or irregularity, was widely applied in fault diagnosis recently [11]. It was first introduced by Shannon in 1948 [12].…”