基于Transformer的网络安全态势预测  

Network security situation prediction based on Transformer

作　　者：赵冬梅[1,2,3] 李志坚 ZHAO Dongmei;LI Zhijian(College of Computer and Cyber Security,Hebei Normal University,Shijiazhuang 050024,China;Hebei Provincial Key Laboratory of Network&Information Security,Hebei Normal University,Shijiazhuang 050024,China;Hebei Provincial Engineering Research Center for Supply Chain Big Data Analytics&Data Security,Hebei Normal University,Shijiazhuang 050024,China)

机构地区：[1]河北师范大学计算机与网络空间安全学院,河北石家庄050024 [2]河北师范大学河北省网络与信息安全重点实验室,河北石家庄050024 [3]河北师范大学河北省供应链大数据分析与数据安全工程研究中心,河北石家庄050024

出　　处：《华中科技大学学报（自然科学版）》2022年第5期46-52,共7页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家自然科学基金资助项目(61672206);河北省省级科技计划资助项目(20310701D);中央引导地方科技发展资金资助项目(216Z0701G).

摘　　要：针对当下网络安全态势预测准确率低的问题,将Transformer用于网络安全态势预测.首先,引入门控循环单元(GRU)来降低样本特征的维度,维度的下降有利于减少训练Transformer的代价和缓解Transformer过拟合问题;然后,将降维后的特征输入Transformer层,通过编码器提取具有时序关系的特征;最后,使用全局平均池化处理提取的特征,以减少全连接层的参数量,减缓过拟合问题.在两个网络安全数据集上的实验表明:该方法可以降低训练时间,并且在准确率、精确率和F1值三个指标上的综合表现优于其他方法.Aiming at the low accuracy of current network security situation prediction,Transformer was used for network security situation prediction.First,the gated recurrent unit(GRU)was introduced to reduce the dimension of sample features,which was conducive to reducing the cost of training Transformer and alleviating the overfitting problem of Transformer.Then,the features after dimensionality reduction were input into Transformer layer,and features with time relation were extracted through the encoder.Finally,the extracted features were processed by global average pooling to reduce the number of parameters in the full connection layer and alleviate the overfitting problem.Experiments on two network security datasets show that the method can reduce the training time,and the comprehensive performance of the method is better than other methods in accuracy,precision and F1.

关 键 词：网络安全 态势预测 TRANSFORMER 门控循环单元(GRU) 降维 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]