Zuo Fengqin, Zhang Damin, Li Lun, He Qing, Deng Jiaxin
College of Big Data and Information Engineering, Guizhou University, Guiyang, 550025, China.
Heliyon. 2024 May 29;10(11):e32087. doi: 10.1016/j.heliyon.2024.e32087. eCollection 2024 Jun 15.
One of the critical technologies to ensure cyberspace security is network traffic anomaly detection, which detects malicious attacks by analyzing and identifying network traffic behavior. The rapid development of the network has led to explosive growth in network traffic, which seriously impacts the user's information security. Researchers have delved into intrusion detection as an active defense technology to address this challenge. However, traditional machine learning methods struggle to capture complex threats and attack patterns when dealing with large-scale network data. In contrast, deep learning methods have the advantages of automatically extracting features from network traffic data and strong generalization capabilities. Aiming to enhance the ability of network anomaly traffic detection, this paper proposes a network traffic anomaly detection based on Deep Residual Shrinkage Network (DRSN), namely "GSOOA-1DDRSN". This method uses an improved Osprey optimization algorithm to select the most relevant and essential features in network traffic, reducing the features' dimensionality. For better detection performance of network traffic anomalies, a one-dimensional deep residual shrinkage network (1DDRSN) is designed as a classifier. Validation is performed using the NSL-KDD and UNSW-NB15 datasets and compared with other methods. The experimental results show that GSOOA-1DDRSN has improved multi-classification accuracy, precision, recall, and F1 Score by approximately 2 % and 3 %, respectively, compared to the 1DDRSN model on two datasets. Additionally, it reduces the time computation costs by 20 % and 30 % on these datasets. Furthermore, compared to other models, GSOOA-1DDRSN offers superior classification accuracy and effectively reduces the number of features.
确保网络空间安全的关键技术之一是网络流量异常检测，它通过分析和识别网络流量行为来检测恶意攻击。网络的快速发展导致网络流量呈爆炸式增长，这严重影响了用户的信息安全。研究人员深入研究入侵检测作为一种主动防御技术来应对这一挑战。然而，传统机器学习方法在处理大规模网络数据时难以捕捉复杂的威胁和攻击模式。相比之下，深度学习方法具有从网络流量数据中自动提取特征和强大泛化能力的优势。为了提高网络异常流量检测能力，本文提出了一种基于深度残差收缩网络（DRSN）的网络流量异常检测方法，即“GSOOA-1DDRSN”。该方法使用改进的鱼鹰优化算法在网络流量中选择最相关和最关键的特征，降低特征维度。为了更好地检测网络流量异常，设计了一维深度残差收缩网络（1DDRSN）作为分类器。使用NSL-KDD和UNSW-NB15数据集进行验证，并与其他方法进行比较。实验结果表明,与两个数据集上的1DDRSN模型相比，GSOOA-1DDRSN的多分类准确率、精确率、召回率和F1分数分别提高了约2%和3%。此外，它在这些数据集上的时间计算成本降低了20%和30%。此外，与其他模型相比，GSOOA-1DDRSN具有更高的分类准确率，并有效减少了特征数量。
