Research On Anomaly Network Traffic Detection Method Based On Deep Learning

With the rapid development of the Internet and the emergence of various network applications,the Internet has gone deep into people’s daily life and become an indispensable part of it.At the same time,all kinds of network threats are increasing day by day,which has brought great challenges to network security.The emergence of new network attack methods and more and more encrypted traffic makes the traditional network security means such as firewall and intrusion detection technology have some problems,such as low accuracy and high false alarm rate.It is difficult to adapt to the current complex network environment and effectively ensure network security.As a method to ensure network security,network traffic detection technology can better identify anomaly network traffic and effectively ensure the safe and stable operation of network environment.In recent years,deep learning algorithms has developed rapidly and achieved excellent results in the fields of computer vision,natural language processing and so on.Deep learning algorithms improves the shortcomings of traditional machine learning algorithms.It can learn hidden information and extract features from input data automatically,and it can effectively detect new attacks and encrypted traffic.Convolutional neural network is good at spatial feature extraction and image recognition,and transformer model is more suitable for processing time series data.Based on that,we designed a network traffic detection model based on deep learning in this dissertation.The main research contents and innovations of this dissertation are as follows:(1)Aiming at the advantages of convolutional neural network in the field of image recognition,we constructed an anomaly network traffic data detection model —Vi-BN-CNN—based on improved convolutional neural network in this dissertation,which transforms traffic data detection into image recognition task.By network traffic data preprocessing,the traffic data is transformed into a two-dimensional gray image,and then the two-dimensional convolutional neural network is used to extract the characteristics of the network traffic data.In order to speed up the model training speed and reduce the impact of model parameter initialization on the training results and avoid over fitting and improve the generalization ability of the model,a batch normalization layer is added to the model.The experimental results show that the model has high detection rate,and the accuracy is above 95%.(2)Network traffic data has time-series characteristics.Aiming at the problem that convolutional neural network cannot extract the long-term dependence in traffic data,a network traffic detection model based on Transformer-CNN model is constructed.The commonly used recurrent neural network can extract the time-series features in the data,but it is difficult to parallelize computing.Therefore,we introduced the transformer model to build a temporal feature extractor in this dissertation.this model can not only extract the temporal features in the data,but also do parallel computing to improve the efficiency of model training.The time-series feature extractor is used to extract temporal features,and the spatial feature extractor is used to extract spatial features,so that more features in the data can be learned by the model.Compared with VI-BN-CNN,the detection rate of the model is further improved(3)At present,the generalization of network model to deal with unbalanced data is poor,and it is difficult to identify the data with few samples.Based on that,we introduced the focal loss function in this dissertation,which can make the model pay more attention to the data that is difficult to be classified correctly through the adjustment of the balance factor,and improve the detection rate of the model for the data with few samples.Through comparative experiments,it is verified that the model using focal loss function has higher accuracy than the model using mean square error loss function and cross entropy loss function.