通信学报 ›› 2021, Vol. 42 ›› Issue (5): 23-40.doi: 10.11959/j.issn.1000-436x.2021109

• 学术论文 • 上一篇    下一篇

基于LSTM与改进残差网络优化的异常流量检测方法

麻文刚, 张亚东, 郭进   

  1. 西南交通大学信息科学与技术学院,四川 成都 611756
  • 修回日期:2021-04-12 出版日期:2021-05-25 发布日期:2021-05-01
  • 作者简介:麻文刚(1993- ),男,甘肃天水人,西南交通大学博士生,主要研究方向为通信系统、信息安全等
    张亚东(1983- ),男,河南商丘人,博士,西南交通大学讲师、硕士生导师,主要研究方向为系统可靠性与安全性理论、系统仿真测试等
    郭进(1960- ),男,四川成都人,博士,西南交通大学教授、博士生导师,主要研究方向为系统安全理论、安全苛求系统设计与验证等
  • 基金资助:
    国家自然科学基金资助项目(61703349);中央高校基本科研业务费专项资金资助项目(2682017CX101);中国铁路总公司科技研究开发计划课题基金资助项目(N2018G062);中国铁路总公司科技研究开发计划课题基金资助项目(K2018G011)

Abnormal traffic detection method based on LSTM and improved residual neural network optimization

Wengang MA, Yadong ZHANG, Jin GUO   

  1. School of Information Science and Technology, Southwest Jiaotong University, Chengdu 611756, China
  • Revised:2021-04-12 Online:2021-05-25 Published:2021-05-01
  • Supported by:
    The National Natural Science Foundation of China(61703349);The Fundamental Research Funds for the Central Universities(2682017CX101);China Railway Corporation Science and Technology Research and Development Project(N2018G062);China Railway Corporation Science and Technology Research and Development Project(K2018G011)

摘要:

传统的网络异常流量检测方法往往存在特征选择差与泛化能力较弱等缺陷,导致检测精度较低。为此,提出了一种基于长短记忆网络(LSTM)与改进残差神经网络优化的异常流量检测方法。首先分析网络流量特征,通过预处理来降低网络流量特征值的差异性;然后设计了一种三层堆叠LSTM网络来提取不同深度的网络流量特征;最后设计了一种带跳跃连接线的改进残差神经网络对LSTM进行优化,改善了深度神经网络中的过拟合与梯度消失等缺点,从而提高网络异常流量检测的准确率。实验表明,所提方法具有较高的训练准确率,数据处理的可视性效果较好,二分类和多分类下的分类准确率分别为 92.3%和 89.3%。与当前入侵检测方法相比,所提方法在精确率、召回率等参数最优时具有最低的误报率。在数据样本在遭到破坏时具有较强的稳健性,同时也具有较好的泛化能力。

关键词: 异常流量检测, 长短记忆网络, 数据池化层, 空洞卷积, 改进残差神经网络

Abstract:

Problems such as a difficulty in feature selection and poor generalization ability were prone to occur when traditional method was exploited to detect abnormal network traffic.Therefore, an abnormal traffic detection method based on the long short term memory network (LSTM) and improved residual neural network optimization was proposed.Firstly, the features and attributes of network traffic were analyzed, and the variability of the feature values was reduced by preprocessing of network traffic.Then, a three-layer stacked LSTM network was designed to extract network traffic features of different depths.Moreover, the problem of weak adaptability of feature extraction was solved.Finally, an improved residual neural network with skipping connecting line was designed to optimize the LSTM.The defects of deep neural network such as overfitting and gradient vanishing were optimized.The accuracy of abnormal traffic detection was improved.Experimental results show that the proposed method has higher training accuracy and better visibility of data processing.The classification accuracy rates under two classifications and multiple classifications are 92.3% and 89.3%.It has the lowest false positive rate when the parameters such as precision rate and recall rate are optimal.Moreover, it has strong robustness when the sample is destroyed.Furthermore, better generalization ability can be achieved.

Key words: abnormal traffic detection, LSTM, data pooling layer, dilated convolution, improved residual neural network

中图分类号: 

No Suggested Reading articles found!