融合RF和CNN的异常流量检测算法  

Anomaly Traffic Detection Algorithm Integrating RF and CNN

作　　者：张志强 暴亚东 ZHANG Zhiqiang;BAO Yadong(Department of Network Security,Shanxi Police College,Taiyuan 030401,China)

机构地区：[1]山西警察学院网络安全保卫系,太原030401

出　　处：《信息网络安全》2024年第11期1655-1664,共10页Netinfo Security

基　　金：教育部产学合作协同育人项目(231005115272053);山西省高等学校教学改革创新项目(J20221297)。

摘　　要：异常流量检测作为网络安全的关键技术之一,对于及时发现网络攻击、溯源取证、防止数据泄露等具有重要意义。针对现有网络异常流量检测方法在准确性方面存在的不足,文章提出一种融合随机森林(RF)和卷积神经网络(CNN)的异常流量检测算法,该算法利用RF进行特征选择和初步分类,有效地减少了输入维度并提高了模型的泛化能力;通过CNN对选定特征进行深层次的模式识别,进一步提升了异常检测的精度。实验结果表明,文章算法相比于传统的检测方法在检测准确率、召回率等方面均有显著提升。Abnormal traffic detection is one of the key technologies in cybersecurity,playing a crucial role in promptly identifying network attacks,tracing evidence,and preventing data leaks.To address the shortcomings in accuracy of existing abnormal traffic detection methods,this paper proposed an anomaly traffic detection algorithm that integrates Random Forest(RF)and Convolutional Neural Network(CNN).This algorithm utilized RF for feature selection and preliminary classification,effectively reducing the input dimensionality and enhancing the model’s generalization capability;it further improved the precision of anomaly detection through deep pattern recognition by CNN on selected features.Experimental results demonstrate that,compared to traditional detection methods,this algorithm significantly enhances performance metrics such as detection accuracy and recall rate.

关 键 词：异常流量检测 融合模型 特征提取 随机森林 CNN 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]