Information Technology Reference

In-Depth Information

Definition 3. Normal Degree

Let
AN
represents the normal behavior sample set in IDS database. Then we define

the similarity between
X
and
AN
as

S

X

AN

, called the normal degree of the behavior

vector
X
. See formula (5).

S
X

AN

(5)

=

Sim

(

X

,

AN

)

=

max{

Sim

(

X

,

AN

),

AN

∈

AN

,

j

=

0

L

,

m

}

j

j

Definition 4: Abnormal Degree

Let
AI
presents the abnormal behavior sample set in IDS database. Then we define the

similarity between
X
and
AI
as

X

AI

S

, called the abnormal degree of the behavior vec-

tor
X
. See formula (6).

S
AI

(6)

=

Sim

(

X

,

AI

)

=

max{

Sim

(

X

,

AI

),

AI

∈

AI

,

j

=

0

L

,

m

}

j

j

Definition 5: Intrusion Probability

Taking both the normal degree and the abnormal degree of
X
into consider, we de-

fine the intrusion probability of
X
as

P

(

X

,

AN

,

AI

)

. It can be calculated by means

of formula (7).

S

X

AI

P

(

X

,

AN

,

AI

)

=

,

(

β

≥

0

(7)

X

AI

X

AN

S

+

β

•

S

In formula 7,

β

is the contribution coefficient of the normal degree of
X
to the intrusion

probability

β

. The value of

is not less than 0.

P

(

X

,

AN

,

AI

)

5 The Dimension Reduction Method of Behavior Samples

5.1 Mapping to 2-Dimension Points

According to formula (3) and formula (4), every network behavior
X
can be respec-

tively result in a normal degree

A
S
,

then,
X
can be mapped into a binary tuples <
u
,
v
>. Regard
u
as the longitudinal co-

ordinates, and
v
as the abscissa, then (
u
,
v
) is a point in a 2-dimensional plane.

Taked notice of

S

X

AN

and anomaly degree

X

AI

. If let
u
=

A
S
v
=

X

S

X

∈
v
, a network behavior will be mapped into a point

within the rectangle region from (0,0) to (1,1). This mapping is illustrated in Figure 4.

Point (
u
1
,
v
1
) and (
u
2
,
v
2
) respectively represent the behavior vector

and

u

∈

[

0

[

0

X
and

X

.

2

Search WWH ::

Custom Search