2002/11/13 by Wenke Lee, Dong Xiang · 2 citations
Computer Science · #Network Security and Intrusion Detection #Advanced Malware Detection Techniques #Anomaly Detection Techniques and Applications
paper · doi:10.1109/secpri.2001.924294
openalex publication_date 2002/11/13 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/29
Anomaly detection is an essential component of protection mechanisms against novel attacks. We propose to use several information-theoretic measures, namely, entropy, conditional entropy, relative conditional entropy, information gain, and information cost for anomaly detection. These measures can be used to describe the characteristics of an audit data set, suggest the appropriate anomaly detection model(s) to be built, and explain the performance of the model(s). We use case studies on Unix system call data, BSM data, and network tcpdump data to illustrate the utilities of these measures.