Chi-square Distance在协议异常检测中的应用

针对Juan M提出的一种基于马尔可夫链的随机协议异常检测模型和评估方法存在的不足进行改进．改进后的模型增加了一些必要的状态，初始概率和转换概率更加精确．实验表明，将Chi—Square Distance和马尔可夫链方法相结合来检测协议异常，可克服原方法的不足，能有效检测到SYN Flooding攻击．

Application of Chi-Square Distance to Protocol Anomaly Detection

We made some improvements on the stochastic protocol model presented by Juan M, which was based on Markov Chain. Some necessary states were added to the modified protocol model to make its initial and transition probabilities more precise. Moreover, we combined Chi-Square Distance into Markov Chain method in order to detect the protocol anomaly. The experimental results show that the modified model can efficiently detect SYN Flooding attacks, thus overcoming the shortage of the previous model.