Abstract:

Aiming at the problem of network abnormal flow detection, this paper proposes an abnormal flow detection method based on network flow feature attribute information entropy. This method firstly calculates the four feature attribute information entropies of source port number, destination port number, source IP address and destination IP address which describe the change of network flow feature. At the same time, normalization is performed to reduce the impact of abnormal sample data on classification performance. Then, the adaptive genetic algorithm is used to optimize the penalty parameters and kernel function parameters of the support vector machine classifier to improve the generalization ability of the classifier. At the same time, the crossover operator and mutation operator of the genetic algorithm are improved to reduce the training time of the support vector machine classifier. Finally, the trained support vector machine classifier is used to recognize the change of the four flow feature attribute information entropies to realize the network abnormal flow detection. Simulation experiments show that the four flow feature attribute information entropies extracted by the method can effectively characterize abnormal flow change. Under a variety of abnormal flow types, the method has a high abnormal flow recognition rate and a low false positive rate, and the robustness of the detection method is better.

Key words: information entropy, abnormal flow detection, support vector machine, parameter optimization