基于多分类器集成的区块链网络层异常流量检测方法  

Blockchain network layer anomaly traffic detection method based on multiple classifier integration

作　　者：戴千一 张斌[1,2] 郭松 徐开勇 DAI Qianyi;ZHANG Bin;GUO Song;XU Kaiyong(Department of Cryptogram Engineering,Information Engineering University,Zhengzhou 450001,China;Henan Province Key Laboratory of Information Security,Zhengzhou 450001,China)

机构地区：[1]信息工程大学密码工程学院,河南郑州450001 [2]河南省信息安全重点实验室,河南郑州450001

出　　处：《通信学报》2023年第3期66-80,共15页Journal on Communications

基　　金：信息保障技术重点实验室开放基金资助项目(No.KJ-15-109);信息工程大学新兴科研方向培育基金资助项目(No.2016604703);信息工程大学科研基金资助项目(No.2019f3303)。

摘　　要：为提升对区块链网络层混合型攻击流量的综合泛化特征感知能力,增强异常流量检测性能,提出一种具有支持异常数据综合判决机制和强泛化能力的基于多分类器集成的区块链网络层异常流量检测方法。首先,为扩大所用基分类器的输入特征子集差异度,提出基于区分度和冗余信息量特征子集选择算法,特征筛选过程中激励高区分度子集项输出,同时抑制冗余信息生成。其次,在Bagging集成算法中引入随机方差缩减梯度算法动态调整各基模型投票权重,提升对混合型攻击流量的检测泛化能力。最后,为了将集成算法输出的低维数值向量向高维空间映射,提出基于数据场概念的局部离群因子算法,并基于数据点间势差放大各样本数据点空间密度分布差异性,提升异常数据点检测召回率。实验结果表明,相较于单一分类检测器集成方法,所提方法的异常检测准确率、召回率分别平均提升1.57%、2.71%。To improve the comprehensive generalized feature perception ability of mixed attack traffic on the blockchain network layer,and enhance the performance of abnormal traffic detection,a blockchain layer traffic anomaly detection method was proposed that supported the comprehensive judgement of data anomaly with a strong generalisation capability.Firstly,to expand the difference of the input feature subset of the base classifier used,a feature subset selection algorithm based on discrimination degree and redundant information was proposed,and the output of high sensitivity subset terms was stimulated during the feature screening process,while the generation of redundant information was suppressed.Then,the stochastic variance reduction gradient algorithm was introduced into the bagging integration algorithm to realize the dynamic adjustment of the voting weights of each base modeland improve thecapability in detecting the generalised hybrid abnormal attack traffic.Finally,LBoF algorithm was proposed to map the low-dimensional numerical vector output by the integrated algorithm to a high-dimensional space.The discrepancy of data point spatial density distribution of various samples were amplified based on the potential difference between data points to increase the recall rate of anomalous data point detection.The experimental results show that in detecting multiple hybrid attack traffic on blockchain layers,the proposed method presents an increase in the anomaly detection accuracy and recall rate,which is 1.57%and 2.71%,respectively,compared with methods based on a single classifier integration.

关 键 词：区块链网络层 集成学习 机器学习 异常流量检测 

分 类 号：TN393[电子电信—物理电子学]