Adaptive Packet Context-Constrained KL-Divergence Model for Intrusion Detection

Abstract

Recently, intrusion detection research has make some important achievements. A variety of classical machine learning and entropy analyze algorithms has been applied to intrusion detection with varying levels of success. In this paper, we analyze the traffic connection statistics information, and give the definition the In/Out flows normal and abnormal statue. To calculate two classes probability KL-divergence, we proposed a novel DDos detection mechanism, which can robustly detect the DDos attack and abnormal network status through combine the related entropy of packet-context with KL-divergence. Experiment results indicate that the proposed approach can significantly reduce the percentage of false positives. The adaptive model based on related entropy of packet-context has a significant advantage in detection speed and performance.