基于多分类器集成的区块链网络层异常流量检测方法

doi:10.11959/j.issn.1000-436x.2023066

通信学报 ›› 2023, Vol. 44 ›› Issue (3): 66-80.doi: 10.11959/j.issn.1000-436x.2023066

基于多分类器集成的区块链网络层异常流量检测方法

戴千一¹^,², 张斌¹^,², 郭松¹, 徐开勇¹

¹ 信息工程大学密码工程学院，河南郑州 450001
² 河南省信息安全重点实验室，河南郑州 450001

修回日期:2023-03-02 出版日期:2023-03-25 发布日期:2023-03-01
作者简介:戴千一（1994− ），男，陕西西安人，信息工程大学博士生，主要研究方向为区块链安全、区块链网络层流量检测、区块链系统应用、机器学习
张斌（1969− ），男，河南南阳人，博士，信息工程大学教授、博士生导师，主要研究方向为信息系统安全
郭松（1985− ），男，河北保定人，博士，信息工程大学讲师，主要研究方向为信息系统安全
徐开勇（1963− ），男，河南信阳人，信息工程大学研究员，主要研究方向为信息安全与可信计算
基金资助:
信息保障技术重点实验室开放基金资助项目(KJ-15-109);信息工程大学新兴科研方向培育基金资助项目(2016604703);信息工程大学科研基金资助项目(2019f3303)

Blockchain network layer anomaly traffic detection method based on multiple classifier integration

Qianyi DAI¹^,², Bin ZHANG¹^,², Song GUO¹, Kaiyong XU¹

¹ Department of Cryptogram Engineering, Information Engineering University, Zhengzhou 450001, China
² Henan Province Key Laboratory of Information Security, Zhengzhou 450001, China

Revised:2023-03-02 Online:2023-03-25 Published:2023-03-01
Supported by:
The Open Fund Project of Information Assurance Technology Key Laboratory(KJ-15-109);The New Research Direction Cultivation Fund of Information Engineering University(2016604703);The Research Project of Information Engineering University(2019f3303)

摘要/Abstract

摘要：

为提升对区块链网络层混合型攻击流量的综合泛化特征感知能力，增强异常流量检测性能，提出一种具有支持异常数据综合判决机制和强泛化能力的基于多分类器集成的区块链网络层异常流量检测方法。首先，为扩大所用基分类器的输入特征子集差异度，提出基于区分度和冗余信息量特征子集选择算法，特征筛选过程中激励高区分度子集项输出，同时抑制冗余信息生成。其次，在Bagging集成算法中引入随机方差缩减梯度算法动态调整各基模型投票权重，提升对混合型攻击流量的检测泛化能力。最后，为了将集成算法输出的低维数值向量向高维空间映射，提出基于数据场概念的局部离群因子算法，并基于数据点间势差放大各样本数据点空间密度分布差异性，提升异常数据点检测召回率。实验结果表明，相较于单一分类检测器集成方法，所提方法的异常检测准确率、召回率分别平均提升1.57%、2.71%。

关键词: 区块链网络层, 集成学习, 机器学习, 异常流量检测

Abstract:

To improve the comprehensive generalized feature perception ability of mixed attack traffic on the blockchain network layer, and enhance the performance of abnormal traffic detection, a blockchain layer traffic anomaly detection method was proposed that supported the comprehensive judgement of data anomaly with a strong generalisation capability.Firstly, to expand the difference of the input feature subset of the base classifier used, a feature subset selection algorithm based on discrimination degree and redundant information was proposed, and the output of high sensitivity subset terms was stimulated during the feature screening process, while the generation of redundant information was suppressed.Then, the stochastic variance reduction gradient algorithm was introduced into the bagging integration algorithm to realize the dynamic adjustment of the voting weights of each base modeland improve thecapability in detecting the generalised hybrid abnormal attack traffic.Finally, LBoF algorithm was proposed to map the low-dimensional numerical vector output by the integrated algorithm to a high-dimensional space.The discrepancy of data point spatial density distribution of various samples were amplified based on the potential difference between data points to increase the recall rate of anomalous data point detection.The experimental results show that in detecting multiple hybrid attack traffic on blockchain layers, the proposed method presents an increase in the anomaly detection accuracy and recall rate, which is 1.57% and 2.71%, respectively, compared with methods based on a single classifier integration.

Key words: blockchain network layer, ensemble learning, machine learning, anomaly traffic detection

中图分类号:

TN393

戴千一, 张斌, 郭松, 徐开勇. 基于多分类器集成的区块链网络层异常流量检测方法[J]. 通信学报, 2023, 44(3): 66-80.

Qianyi DAI, Bin ZHANG, Song GUO, Kaiyong XU. Blockchain network layer anomaly traffic detection method based on multiple classifier integration[J]. Journal on Communications, 2023, 44(3): 66-80.

图/表 17

图1

图2

图3

图4

图5

表1

图6

图7

图8

图9

图10

图11

图12

图13

图14

图15

图16

参考文献 27

[1]	沈鑫, 裴庆祺, 刘雪峰 . 区块链技术综述[J]. 网络与信息安全学报, 2016,2(11): 11-20.
	SHEN X , PEI Q Q , LIU X F . Survey of block chain[J]. Chinese Journal of Network and Information Security, 2016,2(11): 11-20.
[2]	STEPHEN R , ALEX A . A review on blockchain security[J]. IOP Conference Series:Materials Science and Engineering, 2018:doi.org/10.1088/1757-899x/396/1/012030.
[3]	韩璇, 袁勇, 王飞跃 . 区块链安全问题:研究现状与展望[J]. 自动化学报, 2019,45(1): 206-225.
	HAN X , YUAN Y , WANG F Y . Security problems on blockchain:the state of the art and future trends[J]. Acta Automatica Sinica, 2019,45(1): 206-225.
[4]	江沛佩, 王骞, 陈艳姣 ,等. 区块链网络安全保障：攻击与防御[J]. 通信学报, 2021,42(1): 151-162.
	JIANG P P , WANG Q , CHEN Y J ,et al. Securing guarantee of the blockchain network:attacks and countermeasures[J]. Journal on Communications, 2021,42(1): 151-162.
[5]	TRAMèR F , BONEH D , PATERSON K G . Remote side-channel attacks on anonymous transactions[C]// Proceedings of the 29th USENIX Conference on Security Symposium. New York:ACM Press, 2020: 2739-2756.
[6]	叶聪聪, 李国强, 蔡鸿明 ,等. 区块链的安全检测模型[J]. 软件学报, 2018,29(5): 1348-1359.
	YE C C , LI G Q , CAI H M ,et al. Security detection model of blockchain[J]. Journal of Software, 2018,29(5): 1348-1359.
[7]	曾诗钦, 霍如, 黄韬 ,等. 区块链技术研究综述：原理、进展与应用[J]. 通信学报, 2020,41(1): 134-151.
	ZENG S Q , HUO R , HUANG T ,et al. Survey of blockchain:principle,progress and application[J]. Journal on Communications, 2020,41(1): 134-151.
[8]	HASSAN M U , REHMANI M H , CHEN J . Anomaly detection in blockchain networks:a comprehensive survey[J]. arXiv Preprint,arXiv:2112.06089, 2021.
[9]	KIM J , NAKASHIMA M , FAN W J ,et al. Anomaly detection based on traffic monitoring for secure blockchain networking[C]// Proceedings of 2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC). Piscataway:IEEE Press, 2021: 1-9.
[10]	SYARIF I , ZALUSKA E , PRUGEL-BENNETT A ,et al. Application of bagging,boosting and stacking to intrusion detection[C]// Proceedings of International Workshop on Machine Learning and Data Mining in Pattern Recognition. Berlin:Springer, 2012: 593-602.
[11]	凌玥, 刘玉岭, 姜波 ,等. 基于双层异质集成学习器的入侵检测方法[J]. 信息安全学报, 2021,6(3): 16-28.
	LING Y , LIU Y L , JIANG B ,et al. Intrusion detection method based on double-layer heterogeneous ensemble learner[J]. Journal of Cyber Security, 2021,6(3): 16-28.
[12]	GAIKWAD D P , THOOL R C . Intrusion detection system using bagging ensemble method of machine learning[C]// Proceedings of 2015 International Conference on Computing Communication Control and Automation. Piscataway:IEEE Press, 2015: 291-295.
[13]	DONG X B , YU Z W , CAO W M ,et al. A survey on ensemble learning[J]. Frontiers of Computer Science, 2020,14(2): 241-258.
[14]	杨晓晖, 张圣昌 . 基于多粒度级联孤立森林算法的异常检测模型[J]. 通信学报, 2019,40(8): 133-142.
	YANG X H , ZHANG S C . Anomaly detection model based on multi-grained cascade isolation forest algorithm[J]. Journal on Communications, 2019,40(8): 133-142.
[15]	黄金超, 马颖华, 齐开悦 ,等. 一种基于集成学习的入侵检测算法[J]. 上海交通大学学报, 2018,52(10): 1382-1387.
	HUANG J C , MA Y H , QI K Y ,et al. An ensemble-based intrusion detection algorithm[J]. Journal of Shanghai Jiao Tong University, 2018,52(10): 1382-1387.
[16]	李小剑, 谢晓尧, 徐洋 . 网络流量异常检测方法:SSAE-IWELMAdaBoost[J]. 武汉大学学报(理学版), 2020,66(2): 126-134.
	LI X J , XIE X Y , XU Y . Network traffic anomaly detection method:SSAE-IWELM-AdaBoost[J]. Journal of Wuhan University (Natural Science Edition), 2020,66(2): 126-134.
[17]	ZHANG J Q , WANG Z Z , MENG J J ,et al. Boosting positive and unlabeled learning for anomaly detection with multi-features[J]. IEEE Transactions on Multimedia, 2019,21(5): 1332-1344.
[18]	刘金平, 何捷舟, 马天雨 ,等. 基于KELM选择性集成的复杂网络环境入侵检测[J]. 电子学报, 2019,47(5): 1070-1078.
	LIU J P , HE J Z , MA T Y ,et al. Selective ensemble of KELM-based complex network intrusion detection[J]. Acta Electronica Sinica, 2019,47(5): 1070-1078.
[19]	REDDY D K K , BEHERA H S , PRATYUSHA G M S ,et al. Ensemble bagging approach for IoT sensor based anomaly detection[C]// Proceedings of the Intelligent Computing in Control and Communication. Berlin:Springer, 2021: 647-665.
[20]	OFORI-BOATENG D , DOMINGUEZ I S , AKCORA C ,et al. Topological anomaly detection in dynamic multilayer blockchain networks[C]// Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Berlin:Springer, 2021: 788-804.
[21]	ZHANG R , ZHANG G F , LIU L ,et al. Anomaly detection in bitcoin information networks with multi-constrained meta path[J]. Journal of Systems Architecture, 2020:doi.org/10.1016/j.sysarc.2020.101829.
[22]	JOHNSON R , ZHANG T . Accelerating stochastic gradient descent using predictive variance reduction[C]// Proceedings of the 26th International Conference on Neural Information Processing Systems. New York:ACM Press, 2013: 315-323.
[23]	钱景辉, 梁栋 . 一种基于多标记的局部离群点检测算法[J]. 微电子学与计算机, 2017,34(10): 110-114.
	QIAN J H , LIANG D . Local outlier detection algorithm based on multi-label learning[J]. Microelectronics ＆ Computer, 2017,34(10): 110-114.
[24]	DAI Q Y , ZHANG B , DONG S Q . A DDoS-attack detection method oriented to the blockchain network layer[J]. Security and Communication Networks, 2022,2022: 1-18.
[25]	DAI Q Y , ZHANG B , DONG S Q . Eclipse attack detection for blockchain network layer based on deep feature extraction[J]. Wireless Communications and Mobile Computing, 2022,2022: 1-19.
[26]	XU G , GUO B , SU C ,et al. Am I eclipsed? a smart detector of eclipse attacks for Ethereum[J]. Computers ＆ Security, 2020,88: 101604.
[27]	LAURENS V D M , HINTON G . Viualizing data using t-SNE[J]. Journal of Machine Learning Research, 2008,9(2605): 2579-2605.

参数	参数说明	取值
τ	改进Bagging算法训练模型次数	1 815
η	空间距离加权倍数	8
ζ	离群因子阈值	1.17
N	输入样本集数量	5 000
M	基模型数量	6
δ	场模型中势能函数辐射因子	1.0
μ	组合向量维度	6
κ	模型输出样本类别	2
μ	组合向量维度	6
m	原始特征合集特征项数	126
m'	特征筛选后特征项数	65

基于多分类器集成的区块链网络层异常流量检测方法

Blockchain network layer anomaly traffic detection method based on multiple classifier integration

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 17

参考文献 27

相关文章 15

Metrics

推荐阅读 0

[1]	何高峰, 魏千峰, 肖咸财, 朱海婷, 徐丙凤. 支持数据隐私保护的恶意加密流量检测确认方法[J]. 通信学报, 2022, 43(2): 156-170.
[2]	冯智斌, 徐煜华, 杜智勇, 刘鑫, 李文, 韩昊, 张晓博. 对抗智能干扰的主动防御技术[J]. 通信学报, 2022, 43(10): 42-54.
[3]	陆彦辉, 柳寒, 李航, 朱光旭. 基于多鉴别器生成对抗网络的时间序列生成模型[J]. 通信学报, 2022, 43(10): 167-176.
[4]	梅锴, 赵海涛, 刘潇然, 刘军, 熊俊, 任保全, 魏急波. 高效的基于数据与模型的信道估计算法[J]. 通信学报, 2022, 43(1): 59-70.
[5]	彭长根, 高婷, 刘惠篮, 丁红发. 面向机器学习模型的基于PCA的成员推理攻击[J]. 通信学报, 2022, 43(1): 149-160.
[6]	邹福泰, 谭越, 王林, 蒋永康. 基于生成对抗网络的僵尸网络检测[J]. 通信学报, 2021, 42(7): 95-106.
[7]	麻文刚, 张亚东, 郭进. 基于LSTM与改进残差网络优化的异常流量检测方法[J]. 通信学报, 2021, 42(5): 23-40.
[8]	何遵文, 侯帅, 张万成, 张焱. 通信特定辐射源识别的多特征融合分类方法[J]. 通信学报, 2021, 42(2): 103-112.
[9]	刘留, 张建华, 樊圆圆, 于力, 张嘉驰. 机器学习在信道建模中的应用综述[J]. 通信学报, 2021, 42(2): 134-153.
[10]	孙晓川,李志刚,张明辉,桂冠. 基于集成学习的广域光骨干网多信道传输质量预测方法[J]. 通信学报, 2020, 41(9): 1-7.
[11]	伏玉笋,杨根科. 人工智能在移动通信中的应用：挑战与实践[J]. 通信学报, 2020, 41(9): 190-201.
[12]	陈铁明,金成强,吕明琪,朱添田. 基于样本增强的网络恶意流量智能检测方法[J]. 通信学报, 2020, 41(6): 128-138.
[13]	韩春雨,张永铮,张玉. Fast-flucos：基于DNS流量的Fast-flux恶意域名检测方法[J]. 通信学报, 2020, 41(5): 37-47.
[14]	周鑫,何晓新,郑昌文. 基于图像深度学习的无线电信号识别[J]. 通信学报, 2019, 40(7): 114-125.
[15]	杜学绘,林杨东,孙奕. 基于混合特征的恶意PDF文档检测[J]. 通信学报, 2019, 40(2): 118-128.