基于活跃熵的Web应用入侵检测模型

基于活跃熵的Web应用入侵检测模型 Intrusion Detection Model for Web Applications Based on Alive Entropy 莫秀良 MO Xiuliang 1 2 first-author 常畅 CHANG Chang 1 2 王春东 WANG Chundong 1 2 天津理工大学教育部计算机视觉与系统省部共建重点实验室 天津理工大学教育部计算机视觉与系统省部共建重点实验室 Key Laboratory of Computer Vision and System,Ministry of Education,Tianjin University of Technology Key Laboratory of Computer Vision and System,Ministry of Education,Tianjin University of Technology 天津理工大学天津市智能计算与软件新技术重点实验室 天津理工大学天津市智能计算与软件新技术重点实验室 Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology,Tianjin University of Technology Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology,Tianjin University of Technology 由于现今的一些应用层Web攻击体现出大流量的特征,传统的Web入侵检测技术往往对这类攻击检测能力较弱,本文提出了一种基于活跃熵的Web入侵检测方法.该方法通过对HTTP数据包的截获,提取GET、POST请求参数以及HTTP Header中关键数据,并对其熵值进行分析,利用熵值的变化来发现Web数据流中存在的攻击行为.实验结果表明,本方法能实现此类大流量Web应用攻击行为的检测,有效的弥补了传统检测方法的不足. Since some kinds of Web attacks in application layer reflect large flow characteristics,the traditional web intrusion detection technologies failed to detect those kinds of attacks.This paper presents an intrusion detection model of web applications based on alive entropy.By interception of HTTP packets,we extract GET,POST request parameters and HTTP Header’s critical data and then analyze its alive entropy and detect attacks through irregular alive entropy values.The experimental results show that this method can detect such web attacks against web applications and effectively compensate for the shortcomings of traditional web intrusion detection methods. Web应用 Web攻击 入侵检测 活跃熵 Web applications Web attacks intrusion detection alive entropy 10.14188/j.1671-8836.2014.06.016 TP393.08 天津市科技创新专项资金项目（10FDZDGX00400,11ZCKFGX00900）;天津市教委教改重点项目“十二五”总投项目（C03-0809） 2014-06-01 2021-04-01 6 60