一种基于GRU的半监督网络流量异常检测方法  

Semi-supervised Network Traffic Anomaly Detection Method Based on GRU

作　　者：李海涛[1] 王瑞敏[2] 董卫宇[2] 蒋烈辉[2] LI Haitao;WANG Ruimin;DONG Weiyu;JIANG Liehui(School of Cyber Science and Engineering,Zhengzhou University,Zhenzhou 450001,China;State Key Laboratory of Mathematical Engineering and Advanced Computing,Information Engineering University,Zhenzhou 450001,China)

机构地区：[1]郑州大学网络空间安全学院,郑州450001 [2]信息工程大学数学工程与先进计算国家重点实验室,郑州450001

出　　处：《计算机科学》2023年第3期380-390,共11页Computer Science

基　　金：国家重点研发计划(2018YFB0804500)。

摘　　要：入侵检测系统(IDS)是在出现网络攻击时能够发出警报的检测系统,检测网络中未知的攻击是IDS面临的挑战。深度学习技术在网络流量异常检测方面发挥着重要的作用,但现有的方法大多具有较高的误报率且模型的训练大多使用有监督学习的方式。为此,提出了一种基于门循环单元网络(GRU)的半监督网络流量异常检测方法(SEMI-GRU)。该方法将多层双向门循环单元神经网络(MLB-GRU)和改进的前馈神经网络(FNN)相结合,采用数据过采样技术和半监督学习训练方式,应用二分类和多分类方式检验网络流量异常检测的效果,并使用NSL-KDD,UNSW-NB15和CIC-Bell-DNS-EXF-2021数据集进行验证。与经典机器学习模型和DNN,ANN等深度学习模型相比,SEMI-GRU方法在准确率、精确率、召回率、误报率和F1分数等指标上的表现均表现更优。在NSL-KDD二分类和多分类任务中,SEMI-GRU在F1分数指标上领先于其他方法,分别为93.08%和82.15%;在UNSW-NB15二分类和多分类任务中,SEMI-GRU在F1分数上的表现优于对比方法,分别为88.13%和75.24%;在CIC-Bell-DNS-EXF-2021轻文件攻击数据集二分类任务中,SEMI-GRU对所有测试数据均分类正确。Intrusion detection system(IDS)is a detection system that can issue an alarm when a network attack occurs.Detecting unknown attacks in the network is a challenge that IDS faces.Deep learning technology plays an important role in network traffic anomaly detection,but most of the existing methods have a high false positive rate and most of the models are trained using supervised learning methods.A gated recurrent unit network(GRU)-based semi-supervised network traffic anomaly detection me-thod(SEMI-GRU)is proposed,which combines a multi-layer bidirectional gated recurrent unit neural network(MLB-GRU)and an improved feedforward neural network(FNN).Data oversampling technology and semi-supervised learning training method are used to test the effect of network traffic anomaly detection using binary classification and multi-classification methods,and NSL-KDD,UNSW-NB15 and CIC-Bell-DNS-EXF-2021 datasets are used for verification.Compared with classic machine learning mo-dels and deep learning models such as DNN and ANN,the SEMI-GRU method outperforms the machines lear-ning and deep learning methods listed in this paper in terms of accuracy,precision,recall,false positives,and F1 scores.In the NSL-KDD binary and multi-class tasks,SEMI-GRU outperforms other methods on the F1 score metric,which is 93.08%and 82.15%,respectively.In the UNSW-NB15 binary and multi-class tasks,SEMI-GRU outperforms the other methods on the F1 score,which is 88.13%and 75.24%,respectively.In the CIC-Bell-DNS-EXF-2021 light file attack dataset binary classification task,all test data are classified correctly.

关 键 词：入侵检测系统 半监督学习 多层双向门循环单元 前馈神经网络 NSL-KDD UNSW-NB15 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]