Study on the Risk Detection about Network Security Based on Grey Theory

Risk detection about network security can discover anomaly traffic in time and decrease the harm and losing caused by network attacks. By means of netflow, packets were collected from Internet. Analyzing these data, four addresses (source IP/port and destination IP/port) were abstracted to form information entropy, which was extended from thermodynamic. Based on information entropy, risk coefficient was defined to describe the whole condition of network security. To forecast the change of risk coefficient, a model was set up according to grey theory. Using a few data, the model can forecast risk coefficient accurately. Simulation and experiments were completed by MATLAB and in LAN. The experiments in LAN prove that information entropy can reflect anomaly traffic caused by DDoS attacks and Internet worms in time and effectively. The simulation by MATLAB shows that by GM(1,1) information entropy and risk coefficient can be forecasted accurately. Now the system has been applied for two years and provides good performance.