基于S-UBayFS特征选择的网络流量异常检测方法  

Network Traffic Anomaly Detection Method Based on S-UBayFS Feature Selection

作　　者：王文强 王传合[1] 燕波 孙小杰[1] 刘鹏[1] WANG Wenqiang;WANG Chuanhe;YAN Bo;SUN Xiaojie;LIU Peng(The Informatization and Network Security Division,Shaanxi Railway Institute,Weinan 714000,China;Shaanxi Engineering Laboratory of High,Performance Concrete,Shaanxi Railway Institute,Weinan 714000,China)

机构地区：[1]陕西铁路工程职业技术学院信息化与网络安全处,陕西渭南714000 [2]陕西铁路工程职业技术学院陕西省高性能混凝土工程实验室,陕西渭南714000

出　　处：《微型电脑应用》2024年第5期28-32,共5页Microcomputer Applications

基　　金：陕西省高职大数据中心建设与运行机制研究(23JM009)。

摘　　要：研究网络流量异常检测的方法,针对传统机器学习方法的局限性,提出一种基于S-UBayFS-GRU的检测算法。该算法分为3个步骤:利用SNHA算法从大量的网络流量特征中筛选出有因果关系的特征,形成“关联链”;利用“关联链”和网络安全领域知识,给特征赋值权重和侧面约束,用UBayFS算法进行特征选择,降低特征维度,提高特征质量;利用GRU循环神经网络对筛选后的特征进行学习和预测,实现网络流量异常检测。实验结果表明,提出的S-UBayFS-GRU算法在各项评价指标上均优于其他方法。We study the method of network traffic anomaly detection,and propose an algorithm based on S-UBayFS-GRU to improve the limitations of traditional machine learning methods.The algorithm is divided into three steps.It uses SNHA algorithm to filter out causally related features from a large number of network traffic features and form a“correlation chain”.It uses the“correlation chain”and network security domain knowledge to assign weights and side constraints to the features.It also uses the“correlation chain”and network security domain knowledge,and uses UBayFS algorithm for feature selection to reduce the feature dimensions and improve the feature quality.GRU recurrent neural network is used to learn and predict the filtered features,and realize the network traffic anomaly detection.Experiment results show that the S-UBayFS-GRU algorithm proposed in this paper outperforms other methods in all evaluation indexes.

关 键 词：网络异常流量检测 SNHA 关联链 UBayFS GRU 

分 类 号：TN91[电子电信—通信与信息系统]