首页|基于深度学习的异常流量检测方法

基于深度学习的异常流量检测方法

扫码查看
基于机器学习的系统在网络安全应用最多的是基于精心设计的输入特征的浅层模型,这种方法的主要限制是手工设计的特征在不同场景和攻击类型下不能很好地被执行,而深度学习模型可以从原始的、未经处理的数据中学习特征表示,从而解决这一问题.基于此,探讨深度学习模型检测异常网络流量的能力,将来自监控字节流的原始测量作为所提出模型的输入,并评估不同的原始流量(数据包和数据流级)的特征表示.提出一种基于深度学习的模型,能够捕捉异常流量的基本统计数据,而不需要任何类型的手工设计的特征.在包含不同类型异常流量的公开流量跟踪上进行实验,结果证明该模型检测异常流量的准确性高,且优于传统的浅层模型.
An Abnormal Traffic Detection Method Based on Deep Learning
The most commonly used machine learning based systems in network security are shallow models based on carefully designed input features.The main limitation of this method is that handcrafted features can not be performed well in different scenarios and attack types,while deep learning model can learn the feature representation from the original,unprocessed data to solve this problem.Based on this,the ability of the deep learning model to detect abnormal network traffic is explored,using the raw measurements from the monitoring byte stream as input to the proposed model,and evaluating the feature representa-tion of the different raw traffic(packets and data streams level).A model based on deep learning is proposed,which can cap-ture basic statistics of abnormal traffic without requiring any type of handcrafted features.Experiments are conducted on public traffic tracking that included different types of abnormal traffic,and the results prove that the model has high accuracy in detec-ting abnormal traffic and is superior to traditional shallow models.

deep learningnetwork securityraw packetabnormal traffic

赵瑞韬、宋金杰

展开 >

天津市公用技师学院,信息应用技术教学部,天津 300380

天津理工大学,计算机科学与工程学院,天津 300382

深度学习 网络安全 原始数据包 异常流量

国家技能人才培养工学一体化课程标准和课程设置方案项目

教材办函[2022]13号

2024

微型电脑应用
上海市微型电脑应用学会

微型电脑应用

CSTPCD
影响因子:0.359
ISSN:1007-757X
年,卷(期):2024.40(3)
  • 8