On the inefficient use of entropy for anomaly detection

Abstract

Entropy-based measures have been widely deployed in anomaly detection systems (ADSes) to quantify behavioral patterns. The entropy measure has shown significant promise in detecting diverse set of anomalies present in networks and end-hosts. We argue that the full potential of entropy-based anomaly detection is currently not being exploited because of its inefficient use. In support of this argument, we highlight three important shortcomings of existing entropy-based ADSes. We then propose efficient entropy usage - supported by preliminary evaluations - to mitigate these shortcomings. © 2009 Springer Berlin Heidelberg.