一种面向类别不平衡SSL VPN加密流量识别方法  

AN ENCRYPTED TRAFFIC IDENTIFYING METHOD FOR CATEGORY UNBALANCED SSL VPN

作　　者：王宇航 姜文刚[1] 翟江涛 王晰晨 戴伟东 张帆 Wang Yuhang;Jiang Wengang;Zhai Jiangtao;Wang Xichen;Dai Weidong;Zhang Fan(School of Electronics and Information,Jiangsu University of Science and Technology,Zhenjiang 212003,Jiangsu,China;School of Intelligent Networks and Information System,Nanjing University of Information Science&Technology,Nanjing 210000,Jiangsu,China;Liangjiang International College,Chongqing University of Technology,Chongqing 400000,China)

机构地区：[1]江苏科技大学电子信息学院,江苏镇江212003 [2]南京信息工程大学智能网络与信息系统研究院,江苏南京210000 [3]重庆理工大学两江国际学院,重庆400000

出　　处：《计算机应用与软件》2023年第12期318-324,349,共8页Computer Applications and Software

基　　金：国家自然科学基金项目(61702235)。

摘　　要：传统方法在处理不平衡的海量高维数据时存在特征提取困难、检测率低的问题。对此,提出一种先使用基于遗传染色体理论的数据合成过采样技术(NEDIL)平衡原始数据集,再利用基于注意力机制的双向GRU网络流量识别模型识别SSL VPN流量的方法。不仅解决了样本不平衡造成的模型拟合问题,同时能够增强关键特征的区分度,解决一般识别模型无法区分时间序列数据重要程度的差异性的问题。对比实验结果表明,该方法在公开的流量数据集上取得了比当前典型方法更好的识别精度,实现了整体高于92%的应用识别准确度。Traditional methods are difficult to extract features and have low detection rate when dealing with unbalanced mass high-dimensional data.To solve this problem,the proposed method used the data synthesis oversampling technology(NEDIL)based on the theory of genetic chromosomes to balance the original data set,and then used the bidirectional GRU network traffic identification model based on attention mechanism to identify SSL VPN traffic.This method not only solved the problem of model underfitting or overfitting caused by sample imbalance,and enhanced the differentiation degree of key features,which solved the problem that the general recognition model could not distinguish the difference in importance degree of time series data.The experimental results show that compared with the current typical methods,the proposed method has better recognition accuracy on the public traffic data set,and the overall application recognition accuracy is higher than 92%.

关 键 词：SSL VPN 不平衡数据集 过采样 深度学习 注意力机制 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]