动态生成Shapelet的网络流量异常检测  

Network traffic anomaly detection with dynamic Shapelet generation

作　　者：霍帅 师智斌[1] 窦建民 郝伟泽 石琼[1] HUO Shuai;SHI Zhi-bin;DOU Jian-min;HAO Wei-ze;SHI Qiong(School of Data Science and Technology,North University of China,Taiyuan 030000,China)

机构地区：[1]中北大学计算机科学与技术学院,山西太原030000

出　　处：《计算机工程与设计》2024年第5期1337-1342,共6页Computer Engineering and Design

基　　金：山西省自然科学基金项目(20210302123075);山西省重点研发计划基金项目(201903D121166)。

摘　　要：当前网络流量异常检测方法大多针对流量特征集构建检测算法,为充分利用网络流量本身数据信息,降低对人为构建特征集的依赖,采用原始网络流量数据,基于对抗性动态Shapelet网络(ADSN),动态学习Shapelet时序特征,提出一种单尺度输入的ADSN(S-ADSN)流量异常检测方法。将网络会话流中用于建立连接的数据转换为时间序列,基于S-ADSN对原始流量序列样本动态学习和生成Shapelet时序特征,计算Shapelet与流量序列之间的距离向量并通过分类器判断流量类别。实验结果表明,所提方法能够动态获取具有辨识性的流量时序特征,具有可解释性和早期检测性优点,实现较高的恶意流量检测精度。Most of the current network traffic anomaly detection methods construct detection algorithms for traffic feature sets.To make full use of the network traffic data information itself and reduce the dependence on artificially constructed feature sets,the original network traffic data was used,and based on the adversarial dynamic Shapelet network(ADSN),the dynamic lear-ning of Shapelet temporal features was used.A single-scale input ADSN(S-ADSN)traffic anomaly detection method was proposed.The data used to establish connections in the network session flow were converted into time series,the Shapelet timing features were dynamically learned and generated based on S-ADSN for the original traffic sequence samples,and the distance vector between the Shapelet and the traffic sequence was computed and the traffic category was determined by a classifier.Experimental results show that the proposed detection method can dynamically obtain discriminative traffic timing features,has the advantages of interpretability and early detection,and it can realize high malicious traffic detection accuracy.

关 键 词：网络流量 异常检测 时间序列 时序特征 特征学习 卷积神经网络 生成对抗网络 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]