基于置信度与级联结构的未知网络流量检测  

Unknown network traffic detection based on confidence information and cascade structure

作　　者：吴志远 董育宁[1] 李涛[1] WU Zhiyuan;DONG Yuning;LI Tao(School of Communications and Information Engineering,Nanjing University of Posts and Telecommunications,Nanjing 210003,China)

机构地区：[1]南京邮电大学通信与信息工程学院,南京210003

出　　处：《智能计算机与应用》2024年第3期181-186,共6页Intelligent Computer and Applications

摘　　要：为了提升开集流识别性能,本文在对已知类和新类的置信度分布分析基础上,提出一种基于置信度信息与级联结构的未知网络流量检测方法。该方法通过级联结构,先将具有高置信度的新类样本检测出来;利用最大置信度差对新类和已知类进行分类;利用最大置信度对已知类进行细分类。为了更好地检测高置信度新类,还设计了从未标记数据筛选伪负样本的算法。实验表明,与现有代表性方法相比,本文方法的已知类F1提高约13%,新类F1提高约3%,总体准确率提高约5%,训练和分类耗时也明显少于现有方法。In order to improve the performance of open set flow recognition,this paper proposes an unknown network traffic detection method based on confidence and cascade structure,based on the analysis of confidence distribution of known and new classes.This method uses a cascade structure to firstly detect new class samples with high confidence,then uses the maximum confidence difference to classify the new and known classes,and uses the maximum confidence to finely classify the known classes.In order to better detect new classes with high confidence,an algorithm for filtering pseudo negative samples from unlabeled data is also designed.The experiment shows that compared with the existing representative method,the F1 of known class is increased by 13%,and the F1 of new class is increased by 3%,and the overall accuracy is increased by 5%.Training and classification are also significantly less time-consuming than existing method.

关 键 词：开集流识别 置信度 未知网络流量检测 未标记数据 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]