混合SVM结合信息熵检测ICMP隐通道*

攻击者可以将生成的任意信息隐藏在ICMP的有效负载中传递出去，构成了ICMP负载隐通道。在分析ICMP数据流熵标准差和熵值分布特性的基础上，提出了基于信息熵的样本集缩减策略。为提高采用标准支持向量机(SVM)的学习能力与推广能力，建立了若干选取规则，构造出一种有效的混合核函数。最后采用混合SVM结合信息熵的方法检测ICMP隐通道，取得了较快的分类速度和较高的检测率。实验结果表明，采用混合SVM结合信息熵检测ICMP隐通道的方法，是有效的、可行的。

ICMP covert channel detection by

For the problem of localization accuracy in wireless sensor network,this paper proposed an optimal selection algorithm of beacons based on distance and CRLB.Analyzed the impact of distance and geometry between beacons and node, and then selected a specific subset of beacons that minimize the CRLB over all possible subsets.The experiment and simulation results show that the proposed algorithm performs well compare with the beacon selection algorithm based on distance, and meanwhile,it also provides reference for selecting an optimal beacon subset to improve localization accuracy or reduce computation.