基于CNN+GRU的网络恶意流量检测算法  

Network Malicious Traffic Detection Algorithm Based on CNN+GRU

作　　者：高新成 魏壮壮 王莉利[2] 李林旭 GAO Xin-cheng;WEI Zhuang-zhuang;WANG Li-li;LI Lin-xu(Modern Educational Technology Center,Northeast Petroleum University,Daqing Heilongjiang 163318,China;College of Computer and Information Technology,Northeast Petroleum University,Daqing Heilongjiang 163318,China)

机构地区：[1]东北石油大学现代教育技术中心,黑龙江大庆163318 [2]东北石油大学计算机与信息技术学院,黑龙江大庆163318

出　　处：《计算机仿真》2024年第3期388-394,469,共8页Computer Simulation

基　　金：国家自然科学基金(61702093);黑龙江省自然科学基金(F2018003);东北石油大学引导性创新基金(2020YDL-03)。

摘　　要：针对网络恶意流量检测精确度和效率低等问题,提出了一种基于CNN+GRU算法的网络异常流量检测模型(CN-RU)。模型使用卷积神经网络和门控循环单元来分别自动化提取流量的空间和时间特征,全方位的收集网络流量特征。模型使用多个小卷积核和少参数的门控循环单元来准确提取流量特征的同时减小模型参数,达到提高检测精度与效率的目的。实验使用ISCX IDS2012、CIC-IDS2017、UNSW-NB15三种数据集进行效果评估,对比不同算法的网络流量检测模型,实验结果表明所提出的CNN+GRU结构模型解决了神经网络模型梯度消失问题的同时大幅度提高准确率和检测效率。模型具有较高的应用价值,在网络安全管理应用上有更好的普适性。In order to solve the problems that the low accuracy and efficiency of network malicious traffic detection,this paper proposes a network abnormal traffic detection model based on CNN+GRU algorithm(CN-RU).The model uses convolutional neural network and gated recurrent unit to automatically extract the spatial and temporal characteristics of traffic respectively and collect the network traffic characteristics in an all-around way.The model uses multiple small convolution kernels and gated recurrent units with few parameters to accurately extract traffic features and reduce model parameters to achieve the purpose of improving detection accuracy and efficiency.In the experiment,ISCX IDS2012,CIC-IDS2017 and UNSW-NB15 were used to evaluate the effect,and network trafic detection models with different algorithms were compared.The experimental results show that the CNN+GRU structure model proposed in this paper solves the problem of gradient disappearance in the neural network model and greatly improves the accuracy and detection efficiency.The model has higher application value and better universality in network security management.

关 键 词：流量检测 特征选择 卷积神经网络 门控循环单元 注意力机制 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]