摘要
由于现今的一些应用层Web攻击体现出大流量的特征,传统的Web入侵检测技术往往对这类攻击检测能力较弱,本文提出了一种基于活跃熵的Web入侵检测方法.该方法通过对HTTP数据包的截获,提取GET、POST请求参数以及HTTP Header中关键数据,并对其熵值进行分析,利用熵值的变化来发现Web数据流中存在的攻击行为.实验结果表明,本方法能实现此类大流量Web应用攻击行为的检测,有效的弥补了传统检测方法的不足.
Since some kinds of Web attacks in application layer reflect large flow characteristics,the traditional web intrusion detection technologies failed to detect those kinds of attacks.This paper presents an intrusion detection model of web applications based on alive entropy.By interception of HTTP packets,we extract GET,POST request parameters and HTTP Header＇s critical data and then analyze its alive entropy and detect attacks through irregular alive entropy values.The experimental results show that this method can detect such web attacks against web applications and effectively compensate for the shortcomings of traditional web intrusion detection methods.
出处
《武汉大学学报（理学版）》
CAS
CSCD
北大核心
2014年第6期543-547,共5页
Journal of Wuhan University:Natural Science Edition
基金
天津市科技创新专项资金项目(10FDZDGX00400
11ZCKFGX00900)
天津市教委教改重点项目"十二五"总投项目(C03-0809)
关键词
WEB应用
WEB攻击
入侵检测
活跃熵
Web applications
Web attacks
intrusion detection
alive entropy
