一种基于半监督学习的网络异常流量检测方法  

A semi-supervised learning based approach for network anomalous traffic detection

作　　者：钟昱 黄振南 谢惠超 陈宁江[2,3,4] ZHONG Yu;HUANG Zhennan;XIE Huichao;CHEN Ningjiang(School of Electrical Engineering,Guangxi University,Nanning 530004,China;School of Computer,Electronics and Information,Guangxi University,Nanning 530004,China;Guangxi Intelligent Digital Services Research Center of Engineering Technology,Nanning 530004,China;Key Laboratory of Parallel,Distributed and Intelligent Computing(Guangxi University),Education Department of Guangxi Zhuang Autonomous Region,Nanning 530004,China)

机构地区：[1]广西大学电气工程学院,广西南宁530004 [2]广西大学计算机与电子信息学院,广西南宁530004 [3]广西智能数字服务工程技术研究中心,广西南宁530004 [4]广西高校并行分布与智能计算重点实验室,广西南宁530004

出　　处：《广西大学学报（自然科学版）》2024年第3期563-574,共12页Journal of Guangxi University（Natural Science Edition）

基　　金：国家自然科学基金项目(62162003);南宁市重点研发计划基金项目(20221031);广西大学“大学生创新创业训练计划”项目(202210593053)。

摘　　要：针对网络流量数据存在标记样本获取困难、实际数据类别不平衡等问题,提出一种合成数据增强的半监督网络异常流量检测方法(SEASAND)。SEASAND利用无标记数据辅助模型学习,只需少量的有标签数据即可达到较高识别准确率,降低了训练成本。考虑一致性正则和熵最小化原则,通过混合采样解决网络流量数据不平衡的问题,并采用混合样本算法对样本进行二次数据增强,提高了对无标记数据的利用效率。最后利用一维残差网络Resnet1D 18对数据增强后的数据集进行训练。SEASAND在KDDCup9910、UNSW-NB15、CICIDS2017数据集上进行仿真实验,结果表明,与相关算法对比,SEASAND在少样本、多分类问题上具有较好的性能,降低了对有标记样本量的需求。Addressing the challenges such as difficulty in obtaining labeled samples and class imbalance in network traffic data,a semi-supervised approach with augmented synth data for anomalous network traffic detection called SEASAND was proposed.Leveraging unlabeled data for model learning,SEASAND achieved high identification accuracy with minimal labeled data,thereby reducing training costs.The method incorporates consistency regularization and entropy minimization principles,addressing the issue of imbalanced network traffic data through mixed sampling.Additionally,a hybrid sample algorithm is employed to augment the samples,enhancing the utilization efficiency of unlabeled data.The augmented dataset is then trained using the one-dimensional residual network Resnet1D 18.The simulation experimental results on KDDCup9910,UNSW-NB15,and CICIDS2017 datasets show that SEASAND outperforms related algorithms in the context of few-shot multi-class classification,thereby reducing the demand for labeled samples.

关 键 词：半监督学习 网络异常流量检测 混合采样 数据不平衡 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]