了解商业WAF的特征空间和决策边界,在平均值中使用最大
Henryk Gzyl1, Enrique Ter Horst2, Nathalie Peña-Garcia3
1Centro de Finanzas IESA, Caracas 1010, Venezuela.
Entropy (Basel, Switzerland)
|November 24, 2023
概括
网络安全依赖于通过分析连接频率和类型来识别攻击. 这项研究使用最大来确定边际的联合概率,即使有测量错误,为强大的网络攻击特征提供一种无模型的方法.
科学领域:
- 网络安全 网络安全
- 可能性理论概率理论.
- 数据分析 数据分析
背景情况:
- 网络安全需要准确识别和描述针对网络端口的攻击.
- 监控用户访问请求对于了解网络流量模式至关重要.
研究的目的:
- 从它们的边际值中确定连接频率和类型的联合概率分布.
- 为了应对在存在测量错误的情况下推断联合概率的挑战.
- 开发一种灵活的,无模型的方法来描述网络攻击.
主要方法:
- 对网络的连接频率和连接类型的分析.
- 数学表述作为一个带有凸约束的错位线性问题.
- 应用平均最大的方法来解决这个问题.
主要成果:
- 成功确定了从边际值的联合概率分布.
- 最大率方法自然会容纳数据错误.
- 该程序是无模型的,消除了对参数适配的需要.
结论:
- 平均方法中的最大率为确定网络安全中的联合概率分布提供了可靠的解决方案.
- 这种无模型的方法提高了准确地描述网络攻击的能力,即使数据不完美.
- 该技术提供了灵活性,并避免了网络安全分析中参数估计的复杂性.
更多相关视频
08:08Using Wavelet Entropy to Demonstrate how Mindfulness Practice Increases Coordination between Irregular Cerebral and Cardiac Activities
Published on: May 10, 2017
14.7K
13:44Detection of Architectural Distortion in Prior Mammograms via Analysis of Oriented Patterns
Published on: August 30, 2013
42.9K
相关概念视频
Wald-Wolfowitz Runs Test I
655
The Wald-Wolfowitz test, also known as the runs test, is a nonparametric statistical test used to assess the randomness of a sequence of two different types of elements (e.g., positive/negative values, successes/failures). It examines whether the order of the elements in a sequence is random or if there is a pattern or trend present. This nonparametric test applies to any ordered data despite the population and sample data distribution, even if a higher sample size is available.
The test works...
The test works...
655
Classification of Signals
476
In signal processing, signals are classified based on various characteristics: continuous-time versus discrete-time, periodic versus aperiodic, analog versus digital, and causal versus noncausal. Each category highlights distinct properties crucial for understanding and manipulating signals.
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
476
Determination of Expected Frequency
2.2K
Suppose one wants to test independence between the two variables of a contingency table. The values in the table constitute the observed frequencies of the dataset. But how does one determine the expected frequency of the dataset? One of the important assumptions is that the two variables are independent, which means the variables do not influence each other. For independent variables, the statistical probability of any event involving both variables is calculated by multiplying the individual...
2.2K
Expected Frequencies in Goodness-of-Fit Tests
2.5K
A goodness-of-fit test is conducted to determine whether the observed frequency values are statistically similar to the frequencies expected for the dataset. Suppose the expected frequencies for a dataset are equal such as when predicting the frequency of any number appearing when casting a die. In that case, the expected frequency is the ratio of the total number of observations (n) to the number of categories (k).
2.5K
State Space Representation
211
The frequency-domain technique, commonly used in analyzing and designing feedback control systems, is effective for linear, time-invariant systems. However, it falls short when dealing with nonlinear, time-varying, and multiple-input multiple-output systems. The time-domain or state-space approach addresses these limitations by utilizing state variables to construct simultaneous, first-order differential equations, known as state equations, for an nth-order system.
Consider an RLC circuit, a...
Consider an RLC circuit, a...
211
Difference from Background: Limit of Detection
6.4K
The limit of detection (LOD) is the smallest amount of analyte that can be distinguished from the background noise. The LOD value corresponds to the concentration at which the analyte signal is three times larger than the standard deviation of the blank signal. Below this value, the analyte signal cannot be differentiated from the background noise. It is calculated by dividing the calibration slope by 3 times the standard deviation of the blank signals.
The LOD indicates the presence or absence...
The LOD indicates the presence or absence...
6.4K
