Abstract:

An unbalanced protocol recognition method based on the improved Residual U-Net was proposed to solve the challenge of network security posed by the increasing network attacks with the continuous development of the Internet.In the captured network traffic, a small proportion is constituted by malicious traffic, typically utilizing minority protocols.However, existing protocol recognition methods struggle to accurately identify these minority protocols when the class distribution of the protocol data is imbalanced.To address this issue, an unbalanced protocol recognition method was proposed, which utilized the improved Residual U-Net, incorporating a novel activation function and the Squeeze-and-Excitation Networks (SE-Net) to enhance the feature extraction capability.The loss function employed in the proposed model was the weighted Dice loss function.In cases where the recognition accuracies of the minority protocols were low, the loss function value would be high.Consequently, the optimization direction of the model would be dominated by the minority protocols, resulting in improved recognition accuracies for them.During the protocol recognition process, the network flow was extracted from the network traffic and preprocessed to convert it into a one-dimensional matrix.Subsequently, the protocol recognition model extracted the features of the protocol data, and the Softmax classifier predicted the protocol types.Experimental results demonstrate that the proposed protocol recognition model achieves more accurate recognition of the minority protocols compared to the comparison model, while also improving the recognition accuracies of the majority protocols.

Key words: protocol recognition, class unbalance, convolutional neural network, activation function, loss function