首页|基于全局特征学习的挖矿流量检测方法

基于全局特征学习的挖矿流量检测方法

扫码查看
挖矿流量检测属于变长数据分类任务,现有的检测方案如关键字匹配、N-gram特征签名等基于局部特征的分类方法未能充分利用流量的全局特征.使用深度学习模型对挖矿流量进行建模,可以提取挖矿流量的全局特征,提高挖矿流量检测的准确率.文章提出的流量分类模型,使用Transformer编码器提取流量全局特征,然后使用序列总结器处理编码结果,获得用于分类的定长表示.由于挖矿样本在数据集中占比低于 3%,使用准确率衡量模型的分类效果偏差较大,因此,文章综合考虑了模型的精确率和召回率,使用F1 分数对模型的分类效果进行评估.在模型的编码器中使用正余弦位置编码可使模型在测试集上取得 99.84%的F1 分数,精确率达到 100%.
Mining Traffic Detection Method Based on Global Feature Learning
Mining traffic detection is a variable-length data classification task.Existing detection schemes,such as keyword matching and N-gram feature signatures,which are based on local feature classification methods,fail to fully utilize the global features of traffic.By employing deep learning models to model mining traffic,global features within the mining traffic are extracted to enhance the accuracy of mining traffic detection.The traffic classification model proposed in the article first employed a Transformer encoder to extract global features of the traffic,followed by a sequence summarizer to process the encoded results,obtaining a fixed-length representation for classification.Due to the mining samples accounting for less than 3%in the dataset,using accuracy to measure the classification effect of the model leads to significant bias.Therefore,the article comprehensively considered the precision and recall of the model,and employed the F1 score to evaluate the classification performance.Utilizing sinusoidal positional encoding in the model's encoder enables the model to achieve an F1 score of 99.84%on the test set,with a precision rate of 100%.

mining malwaretraffic classificationdeep learningsequence processing

魏金侠、黄玺章、付豫豪、李婧、龙春

展开 >

中国科学院计算机网络信息中心,北京 100083

中国科学院大学计算机科学与技术学院,北京 100049

挖矿木马 流量分类 深度学习 序列处理

中国科学院青年创新促进会项目中国科学院网络安全和信息化专项

2022170CAS-WX2022GC-04

2024

信息网络安全
公安部第三研究所 中国计算机学会计算机安全专业委员会

信息网络安全

CSTPCDCHSSCD北大核心
影响因子:0.814
ISSN:1671-1122
年,卷(期):2024.24(10)