基于网络流量时空特征和自适应加权系数的异常流量检测方法  

Abnormal Traffic Detection Method Based on Traffic Spatial-temporal Features and Adaptive Weighting Coefficients

作　　者：顾伟 行鸿彦[1] 侯天浩 GU Wei;XING Hongyan;HOU Tianhao(School of Electronics and Information Engineering,Nanjing University of Information Science and Technology,Nanjing 210044,China)

机构地区：[1]南京信息工程大学电子与信息工程学院,南京210044

出　　处：《电子与信息学报》2024年第6期2647-2654,共8页Journal of Electronics & Information Technology

基　　金：国家自然科学基金(62171228);国家重点研发计划(2021YFE0105500)。

摘　　要：针对传统异常流量检测模型对流量数据时空特性利用率较低从而导致检测模型性能较差的问题,该文提出一种基于融合卷积神经网络(CNN)、多头挤压激励机制(MSE)和双向长短期记忆(BiLSTM)网络的异常流量检测方法MSECNN-BiLSTM。利用1维CNN挖掘空间尺度下的异常流量特征,并引入MSE,多角度自适应特征加权,强化模型全局特征的关联能力。将网络流量的特征输入BiLSTM,捕捉流量数据的时序依赖性,进一步建立网络流量在时间尺度上的关系模型。利用softmax分类器进行预测分类,实验结果验证了所提模型在异常流量检测领域的有效性。Considering the problem that the performance of the traditional abnormal traffic detection models is limited by the low utilization of spatiotemporal features of traffic data,an abnormal traffic detection method MSECNN-BiLSTM based on the combination of Convolutional Neural Network(CNN),Multi head Squeeze Excitation mechanism(MSE),and Bidirectional Long Short-Term Memory(BiLSTM)network is proposed.The one-dimensional CNN is used to capture abnormal traffic features at spatial scales.The MSE mechanism is introduced to adaptively calibrate the feature weights and strengthen the model’s ability to correlate global features from multiple perspectives.The traffic features are input into BiLSTM to capture the temporal dependencies of the traffic data and further model the relationship of network traffic on the time scale.The softmax classifier is employed for traffic detection.The experimental results verify that the proposed model is effective in the field of abnormal traffic detection.

关 键 词：异常流量检测 卷积神经网络 长短期记忆网络 挤压激励机制 

分 类 号：TN915.08[电子电信—通信与信息系统] TP393.08[电子电信—信息与通信工程]