基于改进的一维级联神经网络的异常流量检测  

NETWORK TRAFFIC ANOMALY DETECTION BASED ON IMPROVEDONE-DIMENSIONAL CASCADED NEURAL NETWORK

作　　者：王婷 王其兵 何志方 闫磊[2] 李远[2] 赵文娜[2] 郝伟 张娅楠 Wang Ting;Wang Qibing;He Zhifang;Yan Lei;Li Yuan;Zhao Wenna;Hao Wei;Zhang Yanan(State Grid Shanxi Electric Power Research Institute,Taiyuan 030000,Shanxi,China;State Grid Shanxi Electric Power Company,Taiyuan 030000,Shanxi,China;College of Information and Computer,Taiyuan University of Technology,Jinzhong 030600,Shanxi,China)

机构地区：[1]国网山西省电力公司电力科学研究院,山西太原030000 [2]国网山西省电力公司,山西太原030000 [3]太原理工大学信息与计算机学院,山西晋中030600

出　　处：《计算机应用与软件》2023年第9期320-326,共7页Computer Applications and Software

基　　金：国家自然科学基金面上项目(61872261)。

摘　　要：提出一种基于改进的一维级联神经网络的异常流量检测模型(Abnormal Traffic Detection Model of Improved One-Dimensional Cascaded Neural Network, ATD-ICNN),与一般的卷积神经网络“卷积-池化-全连接”不同的是,为了充分利用不同网络层输出的特征维度信息,提出一种新的密集特征聚合模块(Dense Feature Aggregation, DFA),为了更大限度地发挥DFA模块的作用,进一步提出增强特征注意力模块(Enhanced Feature Attention, EFA),最后处理得到的维度特征输入Softmax分类器用于最终流量数据分类。实验结果证明所提出的方法与随机森林(RF)方法相比,实现了较高的分类精度,精确率和召回率都提高了4百分点;与Adaboost方法相比,召回率提高了3百分点,表明该方法具有较高的流量异常检测性能。This paper proposes an abnormal traffic detection model based on one-dimensional improved cascaded neural network(ICNN).In order to make full use of different network layer characteristic dimension of the output information,we proposed a new dense feature aggregation(DFA),which was different from general convolution neural network“convolution-pooling-complete connection”.In order to give full play to the role of RFA module,we further proposed the enhanced feature attention(EFA)module.The processed dimensional features were input into the Softmax classifier for the final flow data classification.The experimental results show that the proposed method achieves higher classification accuracy compared with the random forest(RF)method,and the precision rate and recall rate are improved by 4 percentage points.Compared with the Adaboost(RF)method,the recall rate is increased by 3 percentage point,indicating that the method has a high performance of flow anomaly detection.

关 键 词：网络流量 异常检测 级联神经网络 密集特征聚合 增强特征注意力 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]