一种用于不平衡数据的新型网络异常流量检测方法

A Novel Network Abnormal Traffic Detection Method for Imbalanced Network Data

关键词:  网络流量  异常检测  神经网络  深度学习  不平衡数据

Key words:  network traffic  abnormal detection  neural networks  deep learning  imbalanced data

摘要:

现有的网络异常流量检测方法往往忽略了训练样本的不平衡，并且存在对原始流量特征提取不足的问题。为了解决这些问题，本研究提出一种基于混合自适应采样和神经网络组合模型的新型网络异常流量检测方法CL-Net (Convolutional Long Short-Term Memory Networks)。CL-Net首先利用自适应合成采样算法来扩展少量的样本，并使用单边选择算法来减少样本噪声点，建立平衡的数据集；然后，利用卷积神经网络(Convolutional Neural Networks,CNN)和长短期记忆网络(Long Short-Term Memory，LSTM)组合模型，并行提取网络流量的时空特征。在公共数据集NSL-KDD上的实验结果表明，CL-Net可以有效地改善样本不平衡的问题，提高检测精度，模型分类的准确率、精确率和F1分数分别可以达到0.907、0.918和0.917。

Abstract:

Existing network anomalous traffic detection methods often ignore the imbalance of training samples,and there is a problem of insufficient extraction of original traffic features.In order to solve these problems, this study proposes a novel network anomaly traffic detection method CL-Net (Convolutional Long Short-Term Memory Networks) based on a hybrid adaptive sampling and neural network combination model.CL-Net first uses an adaptive synthetic sampling algorithm to expand a small number of samples,and uses a unilateral selection algorithm to reduce sample noise points and establish a balanced dataset.Then,the temporal and spatial characteristics of network traffic are extracted in parallel by using the combination model of Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) network.The experimental results on the public dataset NSL-KDD show that CL-Net can effectively improve the sample imbalance problem and improve the detection accuracy.The accuracy,precision and F1-score of the model classification can reach 0.907, 0.918 and 0.917, respectively.