Entropy operation-based network intrusion detection method and device

Embodiment of the present invention discloses a network-based intrusion detection entropy calculation method, comprising: capturing a data packet network node, the target data obtained by the preprocessing; Construction diagram using the target data; calculating the cross-entropy of all network nodes; all cross entropy sorting network node, the network node to identify key active high; embodiment of the present invention also discloses a network based intrusion detection entropy calculation means; the invention structure into a network graph structure according to FIG. property features network nodes, FIG entropy theory identify the impact of the size of the network nodes in the graph structure and use it as a sort, you can easily get the maximum activity of key network nodes, in order to facilitate further analysis of the network node information to determine whether a network intrusion occurs, or take appropriate measures.