基于分层自编码器的异常网络流量检测  

Malicious Network Traffic Detection Based on Hierarchical Autoencoder

作　　者：张晓青 谷勇浩[1,2,3] 田甜 ZHANG Xiaoqing;GU Yonghao;TIAN Tian(School of Computer Science,Beijing University of Posts and Telecom-munications,Beijing 100876,China;Beijing Key Laboratory of Intelligent Telecommunications Software and Multimedia,Beijing University of Posts and Telecommunications,Beijing 100876,China;Guangdong Provincial Key Laboratory of Information Security Technology,Sun Yat-Sen University,Guangzhou 510275,China;ZTE Corporation,Shenzhen 518057,China)

机构地区：[1]北京邮电大学计算机学院,中国北京100876 [2]北京邮电大学智能通信软件与多媒体北京市重点实验室,中国北京100876 [3]中山大学广东省信息安全技术重点实验室,中国广州510275 [4]中兴通讯股份有限公司,中国深圳518057

出　　处：《中兴通讯技术》2024年第5期81-86,共6页ZTE Technology Journal

基　　金：北京邮电大学中央高校基本科研业务费行动计划项目(2021XDA11-1);中兴通讯产学研合作项目(HC-CN-20200807013);广东省信息安全技术重点实验室开放基金项目(2020B1212060078)。

摘　　要：通过研究现有异常网络流量检测技术存在的问题,提出了一种分层自编码器(HAE)集成模型,以无监督的学习方式摆脱了传统检测方法对于样本标签和攻击样本的依赖,以分层集成的方式学习正常流量的多种分布特征提高单个自编码的检测效果。与现有集成学习方式不同,HAE以串行的方式学习上一自编码器学得不好的样本,降低了训练和测试时间。仿真实验结果表明,相比传统的异常检测方法,HAE具有更高的检测率。By studying the problems existing in the existing malicious network traffic detection technology,a hierarchical autoencoder(HAE)ensemble model is proposed,which gets rid of the dependence of traditional detection methods on sample labels and attack samples by un⁃supervised learning,learns various distribution characteristics of normal traffic by hierarchical integration,and improves the detection effect of single autoencoder.Different from the existing ensemble learning methods,HAE learns the samples that the previous self-encoder does not learn well in a serial way,which reduces the training and testing time.Simulation results show that HAE has a higher detection rate than traditional anomaly detection methods.

关 键 词：分层自编码器 异常网络流量检测 无监督学习方法 集成学习 

分 类 号：TP393.06[自动化与计算机技术—计算机应用技术] TP18[自动化与计算机技术—计算机科学与技术]