Research On Network Traffic Anomaly Detection Technology Based On Software-defined Network Environment

With the advent of the 5G era,the degree of informatization of human society will be further enhanced.Compared with 4G,the application scenarios of 5G network will spread all over the fields of mobile Internet,Internet of Vehicles and industrial Internet.The normal operation of the 5G network is not only related to the degree of informatization of human society,but also directly affects the convenience of life in human society.Software-defined networks can better meet the needs of 5G networks for network slicing,but at present,like traditional networks,they still face the risk of network attacks.Software-defined networks are subject to high levels of cyber attacks,which has affected the production and operation of a large number of enterprises.Therefore,quickly and accurately identifying network traffic anomalies is a crucial means for detecting network attacks.By deploying a network traffic detection and analysis system adapted to the software-defined network environment,meeting the needs of quickly and accurately identifying network attacks is a necessary measure to deal with network attacks and ensure the normal operation of software-defined networks.Software-defined networking has the characteristics of numerous traffic characteristics and unbalanced data distribution.Most current solutions to data imbalances use unsupervised or oversampling methods.Unsupervised schemes are difficult to guarantee accuracy.The oversampling method is prone to overfitting.Therefore,reducing the computational complexity of the model and improving the accuracy of traffic detection in softwaredefined networks are the keys to abnormal traffic detection.Aiming at the problems and challenges of network attacks faced by softwaredefined networks,this paper proposes an abnormal traffic detection method based on the Stacking method and self-attention mechanism(the stacking method and selfattention mechanism,TSMASAM)and the convolution of the hybrid self-attention mechanism The Mixed Self-Attention Mechanism Convolutional Auto Encoder Model(MSAMCAM)effectively improves the accuracy of abnormal traffic detection.details as follows:(1)Aiming at the problem that data features are difficult to mine,this paper proposes TSMASAM,which combines the self-attention mechanism with ensemble learning to make up for the inability of ensemble learning to learn the relationship between data.The model first processes data through a neural network composed of a self-attention mechanism and a deep convolutional network,aiming to automatically learn the correlation between traffic samples and capture the internal structure of the feature space,and provide it to downstream tasks in the form of sample embedding.Then,the model uses the Stacking integration method designed in this paper to detect and identify abnormal network traffic by integrating the sample embedding obtained above and the inspection results of the heterogeneous base learner.Finally,the model is trained under the loss function designed in this paper.By introducing the loss value of the base learner and the regular term composed of it,the influence of the base learner on the overall performance of the model is fully and comprehensively considered,and the model is prevented from falling into overfitting.combined state.The model is based on three public data sets of In SDN,KDD99 and UNSW-NB15,and multiple comparative experiments were conducted to verify the feasibility of the model.And the effect of each module on the model is verified by conducting ablation experiments.(2)Aiming at the problem of data imbalance,this paper proposes MSAMCAM.The model first uses an autoencoder with a hybrid self-attention mechanism for unsupervised learning,allowing the model to be trained effectively without supervision.Afterwards,a linear support vector machine is introduced to classify the samples according to the sample reconstruction information obtained by the autoencoder.The model addresses the problem of data imbalance by using an autoencoder for unsupervised learning on normal samples.The model conducts a variety of comparative experiments on the In SDN public data set to verify the feasibility of the model.And ablation experiments are carried out to verify the influence of each module on the experimental results.