GMTBLC:基于深度学习的双模态网络流量分类  

GMTBLC:a deep learning-based bi-modal network traffic classification method

作　　者：魏德宾[1] 江亲龙 温京龙 王欣睿 WEI Debin;JIANG Qinlong;WEN Jinglong;WANG Xinrui(School of Information Engineering,Dalian University,Dalian 116622,China)

机构地区：[1]大连大学信息工程学院,辽宁大连116622

出　　处：《电信科学》2024年第12期93-106,共14页Telecommunications Science

基　　金：国家自然科学基金资助项目(No.61931004)。

摘　　要：网络流量分类对于网络安全维护和网络管理至关重要,在服务质量(quality of service,QoS)保证、入侵检测等任务中得到了广泛的应用。针对传统流量分类模型对特征提取不足,导致分类准确率较低等问题,提出了基于混合注意力(group mix attention,GMA)的Transformer和双向长短期记忆(bi-directional long short term memory,Bi-LSTM)网络的双模态网络流量分类(group mix transformer and Bi-LSTM for traffic classification,GMTBLC)方法。在数据预处理阶段,通过数据包的有效载荷生成会话内的包级别图像,以减少信息干扰。在分类阶段,图像首先由包混合Transformer(packet group mix transformer,PCMT)模块处理,该模块使用Transformer和GMA捕获全局特征。同时,会话图像由时空特征提取(spatio-temporal feature extraction,SFE)模块处理,其中数据包的空间特征由带有残差连接的卷积神经网络提取,数据包的时间特征由双向LSTM提取。在融合分类层中,通过动态加权机制融合上述全局特征和时空特征,最终完成网络流量分类。在公共数据集ISCX和USTC-TFC2016上进行的实验表明,该模型的分类准确率达99.31%,精确率、召回率和F1值均达到98%以上,相比其他模型分类效果更优。Network traffic classification is crucial for network security maintenance and management,and it has been widely applied in tasks,such as quality of service(QoS)assurance and intrusion detection.To address the issues of traditional traffic classification models,such as insufficient feature extraction and low classification accuracy,a dualmodal network traffic classification method based on group mix attention(GMA)with a transformer and a bidirectional long short-term memory(Bi-LSTM)network,named group mix transformer and Bi-LSTM for traffic classification(GMTBLC),was proposed.In the data preprocessing phase,packet-level images within sessions were generated from the payloads of data packets to reduce information interference.In the classification phase,the images were firstly processed by the packet group mix transformer(PCMT)module,which utilized the transformer and GMA to capture global features.Simultaneously,session images were processed by the spatio-temporal feature extraction(SFE)module,of which the spatial features of packets were extracted by a convolutional neural network with residual connections,and temporal features of packets were extracted by a bi-directional long short-term memory network.In the fusion classification layer,the above global and spatiotemporal features were integrated using a dynamic weighting mechanism to complete network traffic classification.Experimental results on ISCX and USTC-TFC2016 datasets demonstrate that the proposed model achieves a classification accuracy of 99.31%,with precision,recall,and F1-score all above 98%,and outperforms the other models in classification effectiveness.

关 键 词：流量分类 深度学习 注意力机制 TRANSFORMER 长短期记忆网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]