Entropy Analysis Method for Attacks Detection

The paper proposes and implements a network traffic analysis method for detecting attacks, which is based on protocol analysis and the maximum entropy method. To analyze the quality of functioning of the proposed method, we used data from a data set that contains traffic of various protocols and DDoS attacks, UDP floods, TCP SYN streams, Ping of Death attacks, and HTTP flood attacks. The proposed method for analyzing the maximum entropy was software implemented and the results of its work showed high-quality attack detection. The method can detect various attacks with a probability of about 94%, while false-positive values did not exceed 10%. The advantage of the method is the early detection of intrusions, due to the rapid calculation of the maximum entropy using the sliding window method.