论基于熵的特征的影响
On the Impact of Entropy-based Features
- Federal University of Rio Grande do Sul - UFRGS（鲁西南联邦大学）
- Federal University of Santa Maria - UFSM（圣玛丽亚联邦大学）
- Federal University of Rio Grande - FURG（里奥格兰德联邦大学）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
研究网络异常检测中传统统计特征的不足，提出将熵作为附加特征补充传统描述符，集成到机器学习流程中。通过实验对比有无该特征的模型，结果显示能提升分类性能、降低误分类，为增强异常检测流程提供实用方法。
AI中文摘要：
网络异常检测因流量模式日益多样和多变而更具挑战性，传统统计特征难以充分捕捉。本文探索将熵用作支持监督式网络流量分类的附加特征，用熵表示所选流量属性的变异性，补充而非取代传统描述符。将基于熵的特征集成到标准机器学习流程中，通过对比有无该特征训练的模型评估其影响。在公共入侵检测数据集上的实验表明分类性能持续提升，计算成本低，混淆矩阵分析显示误分类减少，尤其在高变异性流量场景中。结果表明基于熵的特征为增强现有异常检测流程提供了简单实用的方法，在轻量级特征工程和可解释性重要的场景中很有吸引力。
英文摘要：
Network anomaly detection is increasingly challenging due to the growing diversity and variability of traffic patterns, which are not always well captured by traditional statistical features. In this work, we explore the use of entropy as an additional feature to support supervised network traffic classification. The main idea is to use entropy to represent variability in selected traffic attributes, complementing conventional descriptors rather than replacing them. We integrate the entropy-based feature into a standard machine learning pipeline and evaluate its impact through a direct comparison between models trained with and without this feature. Experiments conducted on a public intrusion detection dataset show consistent improvements in classification performance, while the additional computational cost remains low. The analysis of confusion matrices indicates a reduction in misclassifications, especially in traffic scenarios with higher variability. Overall, the results suggest that entropy-based features offer a simple and practical way to enhance existing anomaly detection pipelines. This approach is particularly attractive in settings where lightweight feature engineering and interpretability are important, making entropy a useful complement to commonly used traffic features.
