基于信息熵的数据流加密判断算法

针对基于数据流检测木马检测系统的实际需要,提出一种基于信息熵的数据流加密判断算法,引入N-截断熵的概念用于置信区间的计算,并通过仿真建立了可靠的置信区间.该算法通过检测一条数据流的一个数据包,就可以判断整条数据流是否加密,有非常好的效率,可以达到实时在线判断,通过实验验证,算法具有很高的准确率和很低的误报率,算法已应用于基于数据流检测的木马检测系统,完全达到系统要求.

Detection of Encrypted Data-Flow Based on Entropy

According to the requirement of the Trojan detection system based on dataflow checking, an algorithm for detecting encrypted data-flow is proposed in this text. The N-truncated entropy is introduced to compute confidence interval, and the reliable confidence interval is computed. This algorithm can efficiently check a data flow whether it is encrypted through checking one data. By experimental verification, the algorithm has high accuracy and low rate of false positives. This algorithm had been applied in Trojan detection system based on network traffic checking.