基于全局层次化特征融合和多任务学习的异常流量检测方法

NETWORK TRAFFIC ANOMALY DETECTION BASED ON GLOBAL HIERARCHICAL FEATURE FUSION AND MULTI-TASK LEARNING

  • 摘要: 针对当前基于深度学习的方法对于网络流量表征和泛化能力方面较弱的问题,提出一种基于全局层次化特征融合和多任务学习的异常流量检测方法。该文将原始流量以会话流为单位进行切分,构建全局层次化特征融合框架,并行提取会话流空间和时间特征进行残差融合;设计会话记录多分类为主任务,会话流多分类和会话流对是否为上下文关系为辅助任务的多任务学习框架;输入会话流对进行训练和预测。在 TON_IoT 数据集上验证,二分类和多分类的准确率分别为 94.35% 和 91.96%,相较于对比方法,在准确率和精度最优时误报率较低。

     

    Abstract: Aimed at the problem of weak representation and generalization ability of current deep learning-based methods, a method for detecting anomaly network traffic based on global hierarchical feature fusion and multi-task learning is proposed. We segmented the network traffic in units of sessions and fused the spatial and temporal features of session streams extracted by global hierarchical feature fusion framework parallelly. A multi-task learning framework was designed in which the multi-classification of conversation records was the main task, and the multi-classification of conversation flow and whether the conversation flow pair was contextual are auxiliary tasks. We inputted session stream pair for training and prediction. Experimental results on TON-IOT dataset show that accuracy rates of binary classification and multi-classification are 94.35% and 91.96%. Compared with the comparison method, it maintains the lowest false alarm rate when accuracy and precision are optimal.

     

/

返回文章
返回