An approach on detecting network attack based on entropy

There are a large amounts of alerts with high false rate in typical Intrusion Detection System (IDS). The problem about how to identify network attack effectively from huge volume of alerts is becoming a challenging task for security administrators. It gets worse with larger scale of network being monitored by IDS. In this paper we propose an approach on detecting network attack based on entropy from millions of alerts. Shannon entropy is developed firstly to analyze the distribution characteristics of alert with five key attributes including source IP address, destination IP address, source threat, destination threat and datagram length. Then, the Renyi cross entropy is employed to fuse the Shannon entropy vector and detect the anomalies. The IDS used in our experiment is Snort, and the experimental results based on actual network data show that our approach can detect network attack quickly and accurately.