基于时空特征自适应融合网络的流量分类方法  

Traffic classification based on spatiotemporal feature adaptive fusion network

作　　者：杨宇 唐东明[1] 李驹光[1] 肖宇峰[1] Yang Yu;Tang Dongming;Li Juguang;Xiao Yufeng(School of Information Engineering,Southwest University of Science and Technology,Mianyang 621010,China)

机构地区：[1]西南科技大学信息工程学院,绵阳621010

出　　处：《电子测量技术》2024年第3期166-174,共9页Electronic Measurement Technology

基　　金：国家自然科学基金(12175187)项目资助。

摘　　要：针对当前网络流量瞬时涌现导致网络安全事故骤增、网络管理负担加重等问题,基于深度学习技术提出了ResNet和一维VisionTransformer并行的网络结构对网络流量进行识别并分类。其中ResNet可以提取到流量数据在空间上深层次的特征,能够保证流量识别的准确率;一维VisionTransformer可以提取到更具代表性的时序特征。利用注意力机制将两种特征进行自适应融合得到更全面的特征表示,以提高网络识别流量的能力。在ISCX VPNnonVPN数据集上进行实验表明:所提方法在流量的应用程序分类实验中的准确率达到了99.5%,相较于单独的ResNet和一维VisionTransformer以及经典的一维CNN和CNN+长短时记忆网络分别提高了0.9%、3.6%、6.6%和3.3%。在USTC-TFC2016数据集上,所提方法在能够轻松识别流量是否为恶意流量的基础上,实现了对13种应用程序的分类,且平均分类准确率达到了98.92%,证明了其具有识别恶意流量并完成细粒度分类任务的能力。In response to the current surge in network traffic leading to a sudden increase in network security incidents and an added burden on network management,a network architecture based on deep learning techniques has been proposed.This architecture involves the parallel use of ResNet and one-dimensional Vision Transformer for the identification and classification of network traffic.ResNet is capable of extracting deep spatial features from flow data,ensuring high accuracy in traffic recognition.Meanwhile,the one-dimensional Vision Transformer excels at capturing more representative temporal features.By employing an attention mechanism to adaptively merge these two types of features,a more comprehensive feature representation is obtained to enhance the network's capability in traffic identification.Experiments conducted on the ISCX VPN-nonVPN dataset demonstrate that the proposed method achieves an accuracy of 99.5%in application-based traffic classification experiments.Compared to standalone ResNet and one-dimensional Vision Transformer,as well as classical one-dimensional Convolutional Neural Networks(1DCNN)and CNN combined with Long Short-Term Memory(CNN+LSTM),the proposed method shows improvements of 0.9%,3.6%,6.6%,and 3.3%,respectively.On the USTC-TFC 2016 dataset,the proposed method not only easily identifies malicious traffic but also accomplishes the classification of 13 different applications,with an average classification accuracy of 98.92%.This proves its ability to recognize malicious traffic and perform fine-grained classification tasks.

关 键 词：流量分类 ResNet visionTransformer 多头注意力机制 特征融合 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]