| With the increasingly deep integration of the Internet and social life,the Internet is changing the way people learn and work,but at the same time it also exposes us to increasingly serious security threats.Nowadays,network security issues have become the focus of social attention,and network traffic anomaly detection,as one of the key security issues in the network world,is being widely studied and discussed.Despite decades of development,existing network traffic anomaly detection techniques still face challenges in improving detection accuracy,reducing false positive rates,and detecting low-frequency attacks.In this regard,this paper studies network traffic anomaly detection based on deep learning methods and traditional machine learning methods,respectively.The main research work and innovations are as follows:●The Network Traffic Convolutional Transformer(NTCT)model is proposed for network traffic anomaly detection and classification.The Transformer structure is centered on a self-attentive mechanism and uses multi-head attention mechanism for feature extraction.As a sequential model,Transformer is good at learning temporal features as well as capturing long-range feature information.In addition,it overcomes the short-term memory defect in Recurrent Neural Network(RNN),Transformer supports parallelization and has faster computation speed than RNN.However,for network traffic sequences,which are rich in feature information,only using the Transformer structure cannot fully exploit the network traffic information at different scales.In this paper,NTCT model is designed to combine Transformer structure and convolution structure to make it applicable to the field of network traffic classification.Among them,the convolutional structure can establish cross-channel correlation and spatial correlation through convolutional operations,and the convolutional structure is good at capturing local features,but has some difficulties for learning remote dependencies.However,the combination of the two can fully learn spatio-temporal features and achieve the fusion of local and global information,which is of great help to improve the representational and generalization ability of the model.●An improved random forest based multi-classification model for anomalous network traffic is designed for further multi-classification detection.Among the anomalous network traffic,there are inevitably some low-frequency attack types,which account for a very small number of samples and are therefore difficult to be detected.Then how to improve the detection accuracy and recall of low-frequency attack types will be a difficult problem to be solved in this part.In deep learning,the more data,the stronger the learning ability,and it is difficult for small sample data types to learn their corresponding features,thus inevitably leading to poor detection results.And the traditional machine learning methods are based on prior knowledge and are friendly to small samples.Therefore we try to improve on the traditional machine learning.First we select the optimal feature subset for the dataset by filtering plus feature recursive elimination to remove redundant features and reduce the computational cost of the model.The feature-selected dataset is oversampled,and the oversampling can solve the problem of unbalanced proportion of each sample in the dataset,which is of great help to improve the detection rate of low-frequency attack types.Finally,the processed anomalous traffic is input into the improved Random Forest(RF)model for classification.Experiments show that the model proposed in this paper has higher accuracy and recall rate compared with other traditional machine learning models.In particular,the performance is greatly improved for the detection of low-frequency network attack types. |
