Research And Implementation Of Traffic Anomaly Detection Algorithm In Civil Aviation Information Network

With the rapid development of the network,network attacks are becoming more and more serious.In order to accurately identify malicious traffic attacks,abnormal traffic detection algorithm become an important way to make sure security of airport network.To detect traffic anomalies in network traffic,many traffic packets need to be analyzed and the known malicious traffic packets need to be matched with regular expression.Using these methods to detect abnormal traffic requires a lot of computing power,and the detection efficiency and accuracy are not good.At present,multi-feature selection algorithm is generally used for detection,but the connection between multiple features is not considered by multi-feature algorithm,resulting in low accuracy.Machine learning has a natural advantage in this aspect,machine learning algorithm is widely used in traffic anomaly detection.However,traffic anomaly detection based on a single machine learning algorithm is limited,the effect is unstable,generalization ability and other defects.In order to solve these problems,this thesis mainly works in the following three aspects:First,a feature selection method based on voting mechanism is proposed.In this thesis,the method is used to select features,and the selected features are regarded as feature sets.Two datasets were used in this thesis: Tianjin Airport dataset and KDD99 dataset.Random forest,XGBoost and GBDT were respectively used for feature selection and then voting.This method is used to improve the two traffic anomaly detection algorithms proposed in this thesis.Second,an improved Stacking traffic anomaly detection algorithm using Ada Boost and random forest as base learners,Logistic regression as meta-learners,and feature selection based on voting mechanism is proposed.Specifically,the algorithm has a two-layer structure.In the first layer,random forest,Ada Boost and other algorithms are used as base learners to fuse the results of different base learners.The results are then transmitted to the final layer,which uses a Logistic regression algorithm as a meta-classifier to predict the final results and improve the Stacking algorithm with a feature set based on vote selection.The improved Stacking traffic anomaly detection algorithm based on feature selection based on voting mechanism proposed in this thesis has better performance than the single machine learning algorithm.Thirdly,an improved flow anomaly detection algorithm for deep forest is proposed.The function of multi-granularity scanning in deep forest is to carry out feature scanning,but multigranularity scanning requires large computing power and memory,so the feature selection method based on voting is used to replace the multi-granularity scanning in deep forest for improvement.The detection rate of deep forest is improved and the shortcoming of long time of deep forest algorithm is improve.