Research On Abnormal Traffic Characteristics Based On Euclidean Distance Multiscale Entropy

The study of abnormal traffic characteristics is of great significance for studying abnormal behavior in the network.The abnormal traffic characteristics can reflect the characteristics of the attack mode,attack source in the abnormal network.It can help network manager to mine abnormal behavior features from the network,and find out where the abnormality is,and provide support for network security defense.In recent years,there are many methods about traffic characteristics have been proposed in the filed of network security.These methods use the basic physical quantities as artificial input features to determine whether there is abnormal behavior.However,these methods usually only consider the behavioral characteristics of the physical parameters in a single space-time scale entropy,it is difficult to describe the complexity of the network,and can not describe how network behavior occurs,develop accurately.In order to solve these problems,in this paper,we analysis the entropy of the network traffic and perform the dynamic characteristics of the network according to that the entropy theory contains the characteristics of the dynamics of entire system.In this paper,we proposes the EDM-Fuzyy based on the defects of the existing multiscale entropy theory,and EDM-Fuuzy is used to study the abnormal traffic characteristics,and research on network traffic behavior characteristic at different time scales.The main work are as follows:(1)In this paper,the defects of multiscale entropy,composite multiscale entropy,fuzzy entropy and composite multiscale fuzzy entropy are discussed.Multiscale entropy fuzzy entropy based on Euclidean distance is proposed,and its effectiveness is proved by the synthetic white noise,1/f noise and rolling bearing fault experiments.(2)The multiscale fuzzy entropy based on Euclidean distance is used the research of bearing fault detection.In this paper,the combination of this method and artificial neural network is used,and entropy value is used as the feature of bearing fault experiment,and it achieved remarkable results.(3)In this paper,the entropy theory based on Euclidean distance(EDM-Fuzzy)has been proposed.Firstly,multidimensional and hierarchical processing is performed on the obtained public network abnormal traffic data set,and different timesubsequences of network traffic at different levels are obtained.This method proposed in this paper is used as a theoretical tool to calculate the entropy value of the time subsequence of the network transmission protocol in the network traffic,and to study the complexity of different scale networks,and to mine the characteristics of the abnormal traffic through the characteristics of the entropy value sequence.