University of Xiamen, Xiamen 361005, China.
Sensors (Basel). 2023 May 25;23(11):5059. doi: 10.3390/s23115059.
Network traffic anomaly detection is a key step in identifying and preventing network security threats. This study aims to construct a new deep-learning-based traffic anomaly detection model through in-depth research on new feature-engineering methods, significantly improving the efficiency and accuracy of network traffic anomaly detection. The specific research work mainly includes the following two aspects: 1. In order to construct a more comprehensive dataset, this article first starts from the raw data of the classic traffic anomaly detection dataset UNSW-NB15 and combines the feature extraction standards and feature calculation methods of other classic detection datasets to re-extract and design a feature description set for the original traffic data in order to accurately and completely describe the network traffic status. We reconstructed the dataset DNTAD using the feature-processing method designed in this article and conducted evaluation experiments on it. Experiments have shown that by verifying classic machine learning algorithms, such as XGBoost, this method not only does not reduce the training performance of the algorithm but also improves its operational efficiency. 2. This article proposes a detection algorithm model based on LSTM and the recurrent neural network self-attention mechanism for important time-series information contained in the abnormal traffic datasets. With this model, through the memory mechanism of the LSTM, the time dependence of traffic features can be learned. On the basis of LSTM, a self-attention mechanism is introduced, which can weight the features at different positions in the sequence, enabling the model to better learn the direct relationship between traffic features. A series of ablation experiments were also used to demonstrate the effectiveness of each component of the model. The experimental results show that, compared to other comparative models, the model proposed in this article achieves better experimental results on the constructed dataset.
网络流量异常检测是识别和预防网络安全威胁的关键步骤。本研究旨在通过深入研究新的特征工程方法，构建一种新的基于深度学习的流量异常检测模型，显著提高网络流量异常检测的效率和准确性。具体研究工作主要包括以下两个方面：
为了构建更全面的数据集，本文首先从经典流量异常检测数据集 UNSW-NB15 的原始数据入手，结合其他经典检测数据集的特征提取标准和特征计算方法，重新提取和设计原始流量数据的特征描述集，以准确、完整地描述网络流量状态。我们使用本文设计的特征处理方法对数据集 DNTAD 进行了重建，并对其进行了评估实验。实验表明，通过验证经典机器学习算法，如 XGBoost，这种方法不仅不会降低算法的训练性能，反而提高了其运行效率。
本文提出了一种基于 LSTM 和递归神经网络自注意力机制的检测算法模型，用于异常流量数据集中包含的重要时间序列信息。通过该模型，通过 LSTM 的记忆机制，可以学习流量特征的时间依赖性。在 LSTM 的基础上，引入了自注意力机制，可以对序列中不同位置的特征进行加权，使模型能够更好地学习流量特征之间的直接关系。还进行了一系列消融实验，以证明模型中每个组件的有效性。实验结果表明，与其他对比模型相比，本文提出的模型在构建的数据集上取得了更好的实验结果。
