多模态融合与时序特征相残差的异常流量检测方法  

NETWORK TRAFFIC ANOMALY DETECTION WITH RESIDUALS BETWEEN MULTI-MODAL FUSION AND SEQUENTIAL FEATURES

作　　者：刘会景[1] 唐永旺 郑登峰 Liu Huijing;Tang Yongwang;Zheng Dengfeng(Urumqi Vocational University,Urumqi 830001,Xinjiang,China;Information Engineering University,Zhengzhou 450002,Henan,China;National Pipe Network Group,Urumqi 830001,Xinjiang,China)

机构地区：[1]乌鲁木齐职业大学新疆,乌鲁木齐830001 [2]中国人民解放军战略支援部队信息工程大学,河南郑州450002 [3]国家管网集团,新疆乌鲁木齐830001

出　　处：《计算机应用与软件》2025年第3期102-109,共8页Computer Applications and Software

基　　金：国家自然科学基金项目(51774291);国家自然科学基金地区基金项目(51864045);新疆维吾尔自治区自然科学基金项目(2021D01F53);青岛中油华东院安全环保有限公司课题项目(AQ20170807);乌鲁木齐“人才工程”重点培养对象项目(20191010)。

摘　　要：针对当前基于深度学习的方法无法有效融合流量多模特征的问题,提出一种多模融合与时序特征相残差的异常流量检测方法。以会话为单位切分原始流量,获取流量记录的多模态特征;通过跨模态注意力机制进行多模特征融合,进而利用Transformer挖掘流量记录的时序特征;采用残差学习的方法联合多模态融合特征和时序特征进行检测。在CSE-CIC-IDS2018数据集上验证,二分类和多分类的准确率分别为95.19%和90.52%,相较于对比方法,在准确率和精度最优时误报率最低。Aimed at the problem that the current deep learning-based methods cannot effectively fuse multi-modal features of traffic,a method for detecting anomaly traffic with residuals between multi-modal fusion and sequential feature is proposed.We segmented the network traffic in units of sessions and obtained multi-modal features of traffic records.The multi-modal attention was used to merge the multi-modal features,and Transformer was used to mine the temporal features of traffic records.The fusion feature and sequential feature of multi-modal were combined by residual connection to detect.Experimental results on CSE-CIC-IDS2018 dataset show that accuracy rates under two classifications and multiple classifications are 95.19%and 90.52%,respectively.Compared with the comparison method,it maintains the lowest false alarm rate when accuracy and precision are optimal.

关 键 词：深度学习 多模态融合 时序特征 残差学习 注意力机制 异常流量 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]