首页|一种基于半监督学习的网络异常流量检测方法

一种基于半监督学习的网络异常流量检测方法

扫码查看
针对网络流量数据存在标记样本获取困难、实际数据类别不平衡等问题,提出一种合成数据增强的半监督网络异常流量检测方法(SEASAND).SEASAND利用无标记数据辅助模型学习,只需少量的有标签数据即可达到较高识别准确率,降低了训练成本.考虑一致性正则和熵最小化原则,通过混合采样解决网络流量数据不平衡的问题,并采用混合样本算法对样本进行二次数据增强,提高了对无标记数据的利用效率.最后利用一维残差网络Resnet1D-18对数据增强后的数据集进行训练.SEASAND在KDDCup99-10、UNSW-NB15、CICIDS2017数据集上进行仿真实验,结果表明,与相关算法对比,SEASAND在少样本、多分类问题上具有较好的性能,降低了对有标记样本量的需求.
A semi-supervised learning based approach for network anomalous traffic detection
Addressing the challenges such as difficulty in obtaining labeled samples and class imbalance in network traffic data,a semi-supervised approach with augmented synth data for anomalous network traffic detection called SEASAND was proposed.Leveraging unlabeled data for model learning,SEASAND achieved high identification accuracy with minimal labeled data,thereby reducing training costs.The method incorporates consistency regularization and entropy minimization principles,addressing the issue of imbalanced network traffic data through mixed sampling.Additionally,a hybrid sample algorithm is employed to augment the samples,enhancing the utilization efficiency of unlabeled data.The augmented dataset is then trained using the one-dimensional residual network Resnet1D-18.The simulation experimental results on KDDCup99-10,UNSW-NB15,and CICIDS2017 datasets show that SEASAND outperforms related algorithms in the context of few-shot multi-class classification,thereby reducing the demand for labeled samples.

semi-supervised learningnetwork anomaly traffic detectionmixed samplingdata imbalance

钟昱、黄振南、谢惠超、陈宁江

展开 >

广西大学 电气工程学院,广西 南宁 530004

广西大学 计算机与电子信息学院,广西南宁 530004

广西智能数字服务工程技术研究中心,广西南宁 530004

广西高校并行分布与智能计算重点实验室,广西南宁 530004

展开 >

半监督学习 网络异常流量检测 混合采样 数据不平衡

国家自然科学基金项目南宁市重点研发计划基金项目广西大学大学生创新创业训练计划项目

6216200320221031202210593053

2024

广西大学学报(自然科学版)
广西大学

广西大学学报(自然科学版)

CSTPCD北大核心
影响因子:0.767
ISSN:1001-7445
年,卷(期):2024.49(3)