Abstract: Nowadays there isn’t yet adequately competent test dataset for payload based network anomaly intrusion detection system. A simulation network dataset construction approach based on virtual keywords is proposed, and the byte frequency distribution based models are tested on it. Experiment results indicate that the method provides dataset with controllable abnormal degree; detection threshold depends on characteristic of dataset including packets length distribution, deviation of normal/abnormal access to training data, etc. The single packet frequency distribution model is more sensitive to the alteration of abnormal degree of payload data than connection based model.

Key words: simulation dataset, byte frequency distribution, payload anomaly detection, Network Intrusion Detection System（NIDS）

摘要： 为解决目前网络负载异常入侵检测领域缺乏有效、针对性的测试数据集的问题，提出一种基于虚拟关键字的构造模拟网络数据集的方法。并用它对基于字节频度分布的异常检测模型进行了测试分析。实验结果表明，模拟数据集提供了一种负载内容异常程度可控的测试数据集；检测阈值和网络环境的数据特性包括数据包尺寸分布情况、异常和正常访问相对于训练数据的偏离程度等有关。单包频度分布模型相比连接模型对负载数据异常程度的变动有更好的灵敏度。

关键词: 模拟数据集, 字节频度分布, 负载异常检测, 网络入侵检测系统