基于样本增强的网络恶意流量智能检测方法

doi:10.11959/j.issn.1000-436x.2020122

Abstract

Abstract:

To address the problem that the existing methods of network traffic anomaly detection not only need a large number of training sets,but also have poor generalization ability,an intelligent detection method on network malicious traffic based on sample enhancement was proposed.The key words were extracted from the training set and the sample of the training set was enhanced based on the strategy of key word avoidance,and the ability for the method to extract the text features from the training set was improved.The experimental results show that,the accuracy of network traffic anomaly detection model and cross dataset can be significantly improved by small training set.Compared with other methods,the proposed method can reduce the computational complexity and achieve better detection ability.

Key words: sample enhancement, anomaly detection, traffic detection, machine learning

CLC Number:

TP309

Tieming CHEN,Chengqiang JIN,Mingqi LYU,Tiantian ZHU. Intelligent detection method on network malicious traffic based on sample enhancement[J]. Journal on Communications, 2020, 41(6): 128-138.

Figures/Tables 9

名称	计算式
TPR	$\frac{TP}{TP + FN}$
FPR	$\frac{FP}{FP + TN}$
精确度	$\frac{TP}{TP + FP}$
召回率	$\frac{TP}{TP + FN}$
F-measure	$2 \frac{precision \times recall}{precision + recall}$
准确率	$\frac{TP + TN}{TP + TN + FP + FN}$

References 27

[1]	谢逸, 余顺争 . 基于Web用户浏览行为的统计异常检测[J]. 软件学报, 2007,18(4): 967-977.
	XIE Y , YU S Z . Anomaly detection based on Web users' browsing behaviors[J]. Journal of Software, 2007,18(4): 967-977.
[2]	ZHANG X , ZHAO J , LECUN Y . Character-level convolutional networks for text classification[C]// Advances in neural information processing systems. Massachusetts:MIT Press, 2015: 649-657.
[3]	LU X , ZHENG B , VELIVELLI A ,et al. Enhancing text categorization with semantic-enriched representation and training data augmentation[J]. Journal of the American Medical Informatics Association, 2006,13(5): 526-535.
[4]	ZOLOTUKHIN M , H?M?L?INEN T , KOKKONEN T , .et al. Analysis of http requests for anomaly detection of Web attacks[C]// 2014 IEEE 12th International Conference on Dependable,Autonomic and Secure Computing. Piscataway:IEEE Press, 2014: 406-411.
[5]	PARK S , KIM M , LEE S . Anomaly detection for HTTP using convolutional autoencoders[J]. IEEE Access, 2018,6: 70884-70901.
[6]	YU Y , LIU G , YAN H ,et al. Attention-based Bi-LSTM model for anomalous HTTP traffic detection[C]// 2018 15th International Conference on Service Systems and Service Management. Piscataway:IEEE Press, 2018: 1-6.
[7]	YANG W , ZUO W , CUI B . Detecting malicious URLS via a keyword-based convolutional gated-recurrent-unit neural network[J]. IEEE Access, 2019,7: 29891-29900.
[8]	ARZHAKOV A V , TROITSKIY S S , VASILYEV N P ,et al. Development and implementation a method of detecting an attacker with use of HTTP network protocol[C]// 2017 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering. Piscataway:IEEE Press, 2017: 100-104.
[9]	XU F , PAN H , CAO Z ,et al. Identifying malware with HTTP content type inconsistency via header-payload comparison[C]// 2017 IEEE 36th International Performance Computing and Communications Conference. Piscataway:IEEE Press,, 2017: 1-7.
[10]	TORRANO-GIMéNEZ C , PEREZ-VILLEGAS A , ALVAREZ MARANóN G . An anomaly-based approach for intrusion detection in Web traffic[J]. Journal of Information Assurance Security, 2010,5(4): 446-454.
[11]	TAX D M J , DUIN R P W . Support vector data description[J]. Machine learning, 2004,54(1): 45-66.
[12]	THANG T M , KIM J . The anomaly detection by using DBSCAN clustering with multiple parameters[C]// 2011 International Conference on Information Science and Applications. Piscataway:IEEE Press, 2011: 1-5.
[13]	CHORA? M KOZIK R . Machine learning techniques applied to detect cyber attacks on Web applications[J]. Logic Journal of the IGPL, 2015,23(1): 45-56.
[14]	KRUEGEL C , VIGNA G . Anomaly detection of Web-based attacks[C]// Proceedings of the 10th ACM conference on Computer and communications security. New York:ACM Press, 2003: 251-261.
[15]	CORONA I , TRONCI R , GIACINTO G . SuStorID:a multiple classifier system for the protection of Web services[C]// Proceedings of the 21st International Conference on Pattern Recognition. Piscataway:IEEE Press, 2012: 2375-2378.
[16]	RINGBERG H , SOULE A , REXFORD J ,et al. Sensitivity of PCA for traffic anomaly detection[C]// ACM SIGMETRICS Performance Evaluation Review. New York:ACM Press, 2007,35(1): 109-120.
[17]	AL-OBEIDAT F , EL-ALFY E S M . Hybrid multicriteria fuzzy classification of network traffic patterns,anomalies,and protocols[J]. Personal and Ubiquitous Computing, 2019,23(5-6): 777-791.
[18]	ERFANI S M , RAJASEGARAR S , KARUNASEKERA S ,et al. High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning[J]. Pattern Recognition, 2016,58: 121-134.
[19]	DU M , LI F , ZHENG G ,et al. Deeplog:anomaly detection and diagnosis from system logs through deep learning[C]// Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New York:ACM Press, 2017: 1285-1298.
[20]	ZHANG M , LU S , XU B . An anomaly detection method based on multi-models to detect Web attacks[C]// 2017 10th International Symposium on Computational Intelligence and Design. Piscataway:IEEE Press, 20172: 404-409.
[21]	CRETU-CIOCARLIE G F , STAVROU A , LOCASTO M E ,et al. Adaptive anomaly detection via self-calibration and dynamic updating[C]// International Workshop on Recent Advances in Intrusion Detection. Berlin:Springer, 2009: 41-60.
[22]	WHITESON S , TANNER B , TAYLOR M E ,et al. Protecting against evaluation overfitting in empirical reinforcement learning[C]// 2011 IEEE symposium on adaptive dynamic programming and reinforcement learning. Piscataway:IEEE Press, 2011: 120-127.
[23]	JIN Y , XIE J , GUO W ,et al. LSTM-CRF Neural Network With gated self-attention for Chinese NER[J]. IEEE Access, 2019,7: 136694-136703.
[24]	KRIZHEVSKY A , SUTSKEVER I , HINTON G E . Imagenet classification with deep convolutional neural networks[C]// Advances in neural information processing systems. Massachusetts:MIT Press, 2012: 1097-1105.
[25]	KIM Y . Convolutional neural networks for sentence classification[J]. arXiv preprint arXiv:1408.5882, 2014: 1746-1751.
[26]	LECUN Y , BOTTOU L , BENGIO Y ,et al. Gradient-based learning applied to document recognition[J]. Proceedings of the IEEE, 1998,86(11): 2278-2324.
[27]	HAN J , KAMBER M . Data mining:concepts and techniques[M]. Berlin: Morgan Kaufmann PublishersPress, 2000.

Metrics

Recommended 0

No Suggested Reading articles found!

样本种类	样本数/条
恶意流量训练集	30 000
恶意流量测试集	10 000
正常流量训练集	30 000
正常流量测试集	10 000
在野SQL注入测试集	614
在野XSS测试集	4 093
在野路径爆破测试集	879

加噪比例	TPR	FPR	精确度	召回率	F-measure	准确率
0	94.56%	48.09%	66.31%	94.56%	77.95%	73.24%
5%	94.64%	20.67%	82.07%	94.64%	87.91%	86.98%
10%	95.63%	17.19%	84.75%	95.63%	89.86%	89.22%
15%	80.15%	16.02%	83.34%	80.15%	81.71%	82.06%
20%	16.71%	15.86%	51.27%	16.71%	25.21%	50.44%
30%	68.62%	20.60%	76.89%	68.62%	72.52%	74.01%
40%	51.91%	5.47%	90.45%	51.91%	65.96%	73.23%
50%	67.20%	13.28%	83.49%	67.20%	74.46%	76.97%

加噪比例	路径爆破识别准确率	SQL注入识别准确率	XSS识别准确率
0	50.00%	50.00%	50.00%
5%	80.13%	80.84%	90.94%
10%	81.23%	81.92%	92.69%
15%	79.15	80.43%	91.71%
20%	45.96%	89.74%	86.42%
30%	45.96%	85.02%	82.97%
40%	100.00%	94.46%	96.63%
50%	86.23%	88.76%	93.31%

预处理方法	TPR	FPR	精确度	召回率	F-measure	准确率
本文方法	95.63%	17.19%	84.75%	89.86%	89.86%	89.22%
文献[5]方法	38.30%	0.75%	98.08%	38.30%	55.09%	68.79%
文献[6]方法	68.12%	28.98%	70.15%	68.12%	69.12%	69.57%
文献[7]方法	82.87%	4.37%	95.00%	82.87%	88.52%	89.25%

预处理方法	在野恶意流量识别准确率
本文方法	72.86%
文献[5]方法	62.28%
文献[6]方法	60.08%
文献[7]方法	66.39%

Intelligent detection method on network malicious traffic based on sample enhancement

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 9

References 27

Related Articles 15

Metrics

Recommended 0

模型	训练数据集准确率	在野恶意流量准确率
本文方法（10%噪声）	89.22%	83.54%
本文方法（无噪声）	73.24%	52.81%

[1]	Qianyi DAI, Bin ZHANG, Song GUO, Kaiyong XU. Blockchain network layer anomaly traffic detection method based on multiple classifier integration [J]. Journal on Communications, 2023, 44(3): 66-80.
[2]	Weigang HUO, Rui LIANG, Yonghua LI. Anomaly detection model for multivariate time series based on stochastic Transformer [J]. Journal on Communications, 2023, 44(2): 94-103.
[3]	Jianxin LIAO, Xiaoyuan FU, Qi QI, Jingyu WANG, Haifeng SUN. 6G-ADM: knowledge based 6G network management and control architecture [J]. Journal on Communications, 2022, 43(6): 3-15.
[4]	Xueyuan DUAN, Yu FU, Kun WANG. Multi-dimensional time series anomaly detection method based on VAE-WGAN [J]. Journal on Communications, 2022, 43(3): 1-13.
[5]	Ping WU, Chaowen CHANG, Zhibin ZUO, Yingying MA. Address overloading-based packet forwarding verification in SDN [J]. Journal on Communications, 2022, 43(3): 88-100.
[6]	Haili SUN, Xiang LONG, Lansheng HAN, Yan HUANG, Qingbo LI. Overview of anomaly detection techniques for industrial Internet of things [J]. Journal on Communications, 2022, 43(3): 196-210.
[7]	Gaofeng HE, Qianfeng WEI, Xiancai XIAO, Haiting ZHU, Bingfeng XU. Confirmation method for the detection of malicious encrypted traffic with data privacy protection [J]. Journal on Communications, 2022, 43(2): 156-170.
[8]	Zhuo CHEN, Miao ZHU, Junwei DU. Multi-view graph neural network for fraud detection algorithm [J]. Journal on Communications, 2022, 43(11): 225-232.
[9]	Zhibin FENG, Yuhua XU, Zhiyong DU, Xin LIU, Wen LI, Hao HAN, Xiaobo ZHANG. Active defense technology against intelligent jammer [J]. Journal on Communications, 2022, 43(10): 42-54.
[10]	Xueyuan DUAN, Yu FU, Kun WANG, Taotao LIU, Bin LI. Network traffic anomaly detection method based on multi-scale characteristic [J]. Journal on Communications, 2022, 43(10): 65-76.
[11]	Yanhui LU, Han LIU, Hang LI, Guangxu ZHU. Time series generation model based on multi-discriminator generative adversarial network [J]. Journal on Communications, 2022, 43(10): 167-176.
[12]	Kai MEI, Haitao ZHAO, Xiaoran LIU, Jun LIU, Jun XIONG, Baoquan REN, Jibo WEI. Efficient model-and-data based channel estimation algorithm [J]. Journal on Communications, 2022, 43(1): 59-70.
[13]	Changgen PENG, Ting GAO, Huilan LIU, Hongfa DING. PCA-based membership inference attack for machine learning models [J]. Journal on Communications, 2022, 43(1): 149-160.
[14]	Futai ZOU, Yue TAN, Lin WANG, Yongkang JIANG. Botnet detection based on generative adversarial network [J]. Journal on Communications, 2021, 42(7): 95-106.
[15]	Wengang MA, Yadong ZHANG, Jin GUO. Abnormal traffic detection method based on LSTM and improved residual neural network optimization [J]. Journal on Communications, 2021, 42(5): 23-40.