Abstract:

Problems such as a difficulty in feature selection and poor generalization ability were prone to occur when traditional method was exploited to detect abnormal network traffic.Therefore, an abnormal traffic detection method based on the long short term memory network (LSTM) and improved residual neural network optimization was proposed.Firstly, the features and attributes of network traffic were analyzed, and the variability of the feature values was reduced by preprocessing of network traffic.Then, a three-layer stacked LSTM network was designed to extract network traffic features of different depths.Moreover, the problem of weak adaptability of feature extraction was solved.Finally, an improved residual neural network with skipping connecting line was designed to optimize the LSTM.The defects of deep neural network such as overfitting and gradient vanishing were optimized.The accuracy of abnormal traffic detection was improved.Experimental results show that the proposed method has higher training accuracy and better visibility of data processing.The classification accuracy rates under two classifications and multiple classifications are 92.3% and 89.3%.It has the lowest false positive rate when the parameters such as precision rate and recall rate are optimal.Moreover, it has strong robustness when the sample is destroyed.Furthermore, better generalization ability can be achieved.

Key words: abnormal traffic detection, LSTM, data pooling layer, dilated convolution, improved residual neural network