Использование Энтропийных Характеристик Сетевого Трафика Для Определения Его Аномальности

Abstract

The number and scale of network computer attacks (intrusions) are constantly growing, which makes the problem of their prompt detection highly relevant. For this, network-level intrusion detection systems are used, based on two approachesabuse detection and anomaly detection, and the second approach is more promising in the face of the constant appearance of new and modified types of intrusions. The main objects of application of anomaly detection techniques are mass attacks (DoS-and DDoS attacks, scanning, spreading of worm viruses, etc.), which are difficult to detect by other (for example, signature-based) methods, since they are often based on regular network interactions.The entropy analysis method for detecting network traffic anomalies, compared to many other methods, is characterized by sufficient simplicity of implementation and speed of operation. The application of the method is based on the general assumption that abnormal traffic is more ordered or structured than normal traffic in some parameters and more chaotic in others, which manifests itself as a decrease or increase in the entropy of these parameters.This paper is devoted to determining the nature of the impact of attacks on the entropy of such traffic parameters as the source and destination IP addresses, as well as the destination port, considering several types of DoS-and DDoS attacks as objects. The author describes an approach to determining entropy (using Shannon entropy). The paper presents the results of the author's model, which reveal the ambiguity of the impact of attacks on entropy characteristics. The results show a clear dependence of such inpact (decrease or increase) depends on factors such as the source, target, attack power, and distribution of normal traffic.Conclusions are made about the possibility of effective detection of anomalies corresponding to DoS and DDoS attacks by analyzing the entropy of network traffic parameters, but only if this analysis is carried out taking into account the distribution of normal traffic and the volumetric characteristics of normal and total traffic.