浏览全部资源
扫码关注微信
信息工程大学密码工程学院,河南 郑州 450001
[ "孙剑文(1988- ),女,北京人,信息工程大学博士生、工程师,主要研究方向为网络流量异常检测、机器学习等。" ]
[ "张斌(1969- ),男,河南南阳人,博士,信息工程大学教授、博士生导师,主要研究方向为信息系统安全等。" ]
[ "常禾雨(1993- ),女,河南郑州人,博士,信息工程大学助理研究员,主要研究方向为人工智能安全、网络信息防御。" ]
收稿日期:2024-09-25,
修回日期:2024-11-19,
纸质出版日期:2025-01-25
移动端阅览
孙剑文,张斌,常禾雨.网络异常检测中的流量表示研究[J].通信学报,2025,46(01):192-209.
SUN Jianwen,ZHANG Bin,CHANG Heyu.Research on traffic representation in network anomaly detection[J].Journal on Communications,2025,46(01):192-209.
孙剑文,张斌,常禾雨.网络异常检测中的流量表示研究[J].通信学报,2025,46(01):192-209. DOI: 10.11959/j.issn.1000-436x.2025003.
SUN Jianwen,ZHANG Bin,CHANG Heyu.Research on traffic representation in network anomaly detection[J].Journal on Communications,2025,46(01):192-209. DOI: 10.11959/j.issn.1000-436x.2025003.
针对网络异常检测中流量表示存在的信息丢失问题,从数据采集粒度入手分析不同流量表示的特征信息维度对异常检测性能的影响。首先,介绍了恶意异常检测中流量表示粒度间的协同与耦合关系,以及异常检测中的流量表示、特征学习和检测三环节间的耦合关系。然后,系统审视流量表示在网络异常检测中的发展轨迹,深入分析了流量表示形式、流量特征学习与流量表示在异常检测中的应用3个方面的国内外研究现状。最后,围绕流量表示在网络异常检测应用中协同耦合的发展趋势对未来研究进行展望。
Aiming to address the problem of information loss in traffic representation for network anomaly detection
the impact of feature information dimension of different traffic representation on anomaly detection performance was analyzed from the perspective of data collection granularity. Firstly
the integrated collaboration between traffic representation granularity and the coupling among traffic representation
feature learning
and detection in malicious anomaly detection was introduced. Subsequently
the evolution of traffic representation in network anomaly detection was systematically reviewed
providing a comprehensive analysis of its forms
feature learning
and application in anomaly detection both globally and domestically. Finally
the future research directions revolving around the collaborative development trend of traffic representation in network anomaly detection were outlined.
JING X Y , YAN Z , PEDRYCZ W . Security data collection and data analytics in the Internet: a survey [J ] . IEEE Communications Surveys & Tutorials , 2019 , 21 ( 1 ): 586 - 618 .
冯光升 , 蒋舜鹏 , 胡先浪 , 等 . 面向物联网的入侵检测技术研究新进展 [J ] . 信息网络安全 , 2024 , 24 ( 2 ): 167 - 178 .
FENG G S , JIANG S P , HU X L , et al . New research progress on intrusion detection techniques for the Internet of things [J ] . Netinfo Security , 2024 , 24 ( 2 ): 167 - 178 .
MILLS R , MARNERIDES A K , BROADBENT M , et al . Practical intrusion detection of emerging threats [J ] . IEEE Transactions on Network and Service Management , 2022 , 19 ( 1 ): 582 - 600 .
THUDUMU S , BRANCH P , JIN J , et al . A comprehensive survey of anomaly detection techniques for high dimensional big data [J ] . Journal of Big Data , 2020 , 7 ( 1 ): 42 .
HOJJATI H , HO T K K , ARMANFARD N . Self-supervised anomaly detection in computer vision and beyond: a survey and outlook [J ] . Neural Networks , 2024 , 172 : 106106 .
ALEESA A M , ZAIDAN B B , ZAIDAN A A , et al . Review of intrusion detection systems based on deep learning techniques: coherent taxonomy, challenges, motivations, recommendations, substantial analysis and future directions [J ] . Neural Computing and Applications , 2020 , 32 ( 14 ): 9827 - 9858 .
TU B T , ZHAO Y , YIN G X , et al . Research on intelligent calculation method of intelligent traffic flow index based on big data mining [J ] . International Journal of Intelligent Systems , 2022 , 37 ( 2 ): 1186 - 1203 .
侯剑 , 鲁辉 , 刘方爱 , 等 . 加密恶意流量检测及对抗综述 [J ] . 软件学报 , 2024 , 35 ( 1 ): 333 - 355 .
HOU J , LU H , LIU F A , et al . Detection and countermeasure of encrypted malicious traffic: a survey [J ] . Journal of Software , 2024 , 35 ( 1 ): 333 - 355 .
付钰 , 王坤 , 段雪源 , 等 . 面向软件定义网络的异常流量检测研究综述 [J ] . 通信学报 , 2024 , 45 ( 3 ): 208 - 226 .
FU Y , WANG K , DUAN X Y , et al . Survey of research on abnormal traffic detection for software defined networks [J ] . Journal on Communications , 2024 , 45 ( 3 ): 208 - 226 .
UMER M A , JUNEJO K N , JILANI M T , et al . Machine learning for intrusion detection in industrial control systems: applications, challenges, and recommendations [J ] . International Journal of Critical Infrastructure Protection , 2022 , 38 : 100516 .
MALDONADO J , RIFF M C , NEVEU B . A review of recent approaches on wrapper feature selection for intrusion detection [J ] . Expert Systems with Applications , 2022 , 198 : 116822 .
SARHAN M , LAYEGHY S , PORTMANN M . Evaluating standard feature sets towards increased generalisability and explainability of ML-based network intrusion detection [J ] . Big Data Research , 2022 , 30 : 100359 .
RUDMAN L , IRWIN B . Characterization and analysis of NTP amplification based DDoS attacks [C ] // Proceedings of the 2015 Information Security for South Africa (ISSA) . Piscataway : IEEE Press , 2015 : 1 - 5 .
HOSSEINI S M , JAHANGIR A H . An effective payload attribution scheme for cybercriminal detection using compressed bitmap index tables and traffic downsampling [J ] . IEEE Transactions on Information Forensics and Security , 2018 , 13 ( 4 ): 850 - 860 .
LUCIA M J D , MAXWELL P E , BASTIAN N D , et al . Machine learning raw network traffic detection [C ] // Proceedings of the Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications III . SPIE , 2021 , 11746 : 185 - 194 .
STABILI D , FERRETTI L , ANDREOLINI M , et al . DAGA: detecting attacks to in-vehicle networks via N-gram analysis [J ] . IEEE Transactions on Vehicular Technology , 2022 , 71 ( 11 ): 11540 - 11554 .
FU Z Q , LIU M X , QIN Y , et al . Encrypted malware traffic detection via graph-based network analysis [C ] // Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses . New York : ACM Press , 2022 : 495 - 509 .
WU H , WU Q Y , CHENG G , et al . SFIM: identify user behavior based on stable features [J ] . Peer-to-Peer Networking and Applications , 2021 , 14 ( 6 ): 3674 - 3687 .
郝唯杰 . 工业网络流量异常智能分析与动态安全策略 [D ] . 杭州 : 浙江大学 , 2022 .
HAO W J . Intelligent analysis and dynamic security strategy of industrial network traffic anomaly [D ] . Hangzhou : Zhejiang University , 2022 .
GUPTA A , GUPTA H P , DUTTA T . A deep learning based traffic flow classification with just a few packets [C ] // Proceedings of the IEEE INFOCOM 2021-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) . Piscataway : IEEE Press , 2021 : 1 - 2 .
ZHOU J T , ZHANG H , JIN D , et al . Dual adversarial transfer for sequence labeling [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2021 , 43 ( 2 ): 434 - 446 .
SIRINAM P , IMANI M , JUAREZ M , et al . Deep fingerprinting: undermining website fingerprinting defenses with deep learning [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2018 : 1928 - 1943 .
KIM J , MONACO J V . User identification in dynamic web traffic via deep temporal features [C ] // Proceedings of the 2021 IEEE Security and Privacy Workshops (SPW) . Piscataway : IEEE Press , 2021 : 282 - 290 .
陈兴蜀 , 陈敬涵 , 邵国林 , 等 . 基于会话流聚合的隐蔽性通信行为检测方法 [J ] . 电子科技大学学报 , 2019 , 48 ( 3 ): 388 - 396 .
CHEN X S , CHEN J H , SHAO G L , et al . A covert communication behavior detection method based on session flow aggregation [J ] . Journal of University of Electronic Science and Technology of China , 2019 , 48 ( 3 ): 388 - 396 .
巩思越 , 刘辉 , 王宝会 . 基于会话统计编码器的恶意加密流量检测方法研究 [J ] . 计算机科学 , 2024 , 51 ( 11 ): 340 - 346 .
GONG S Y , LIU H , WANG B H . Malicious encrypted traffic detection method based on conversation statistical encoder model [J ] . Computer Science , 2024 , 51 ( 11 ): 340 - 346 .
ENGELEN G , RIMMER V , JOOSEN W . Troubleshooting an intrusion detection dataset: the CICIDS2017 case study [C ] // Proceedings of the 2021 IEEE Security and Privacy Workshops (SPW) . Piscataway : IEEE Press , 2021 : 7 - 12 .
MA X B , QU J , LI J F , et al . Pinpointing hidden IoT devices via spatial-temporal traffic fingerprinting [C ] // Proceedings of the IEEE INFOCOM 2020-IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2020 : 894 - 903 .
WANG W , ZHU M , WANG J L , et al . End-to-end encrypted traffic classification with one-dimensional convolution neural networks [C ] // Proceedings of the 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) . Piscataway : IEEE Press , 2017 : 43 - 48 .
ANEJA S , ANEJA N , ISLAM M S . IoT device fingerprint using deep learning [C ] // Proceedings of the 2018 IEEE International Conference on Internet of Things and Intelligence System (IOTAIS) . Piscataway : IEEE Press , 2018 : 174 - 179 .
XU C Y , SHEN J Z , DU X . A method of few-shot network intrusion detection based on meta-learning framework [J ] . IEEE Transactions on Information Forensics and Security , 2020 , 15 : 3540 - 3552 .
GARG S , KAUR K , KUMAR N , et al . A hybrid deep learning-based model for anomaly detection in cloud datacenter networks [J ] . IEEE Transactions on Network and Service Management , 2019 , 16 ( 3 ): 924 - 935 .
SHAPIRA T , SHAVITT Y . FlowPic: a generic representation for encrypted traffic classification and applications identification [J ] . IEEE Transactions on Network and Service Management , 2021 , 18 ( 2 ): 1218 - 1232 .
SHEN M , ZHANG J P , ZHU L H , et al . Accurate decentralized application identification via encrypted traffic analysis using graph neural networks [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 2367 - 2380 .
MONGKOLLUKSAMEE S , VISOOTTIVISETH V , FUKUDA K . Combining communication patterns & traffic patterns to enhance mobile traffic identification performance [J ] . Journal of Information Processing , 2016 , 24 ( 2 ): 247 - 254 .
PREMKUMAR A , SCHNEIDER M , SPIVEY C , et al . Graph representation learning for context-aware network intrusion detection [C ] // Proceedings of the Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications V . SPIE , 2023 , 12538 : 82 - 92 .
AHMED M E , ULLAH S , KIM H . Statistical application fingerprinting for DDoS attack mitigation [J ] . IEEE Transactions on Information Forensics and Security , 2019 , 14 ( 6 ): 1471 - 1484 .
HOLLAND J , SCHMITT P , FEAMSTER N , et al . New directions in automated traffic analysis [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2021 : 3366 - 3383 .
ZOLOTUKHIN M , HÄMÄLÄINEN T , KOKKONEN T , et al . Increasing web service availability by detecting application-layer DDoS attacks in encrypted traffic [C ] // Proceedings of the 2016 23rd International Conference on Telecommunications (ICT) . Piscataway : IEEE Press , 2016 : 1 - 6 .
XU G Q , GUO B J , SU C H , et al . Am I eclipsed? A smart detector of eclipse attacks for Ethereum [J ] . Computers & Security , 2020 , 88 : 101604 .
BHUYAN M H , BHATTACHARYYA D K , KALITA J K . A multi-step outlier-based anomaly detection approach to network-wide traffic [J ] . Information Sciences , 2016 , 348 : 243 - 271 .
HAMAMOTO A H , CARVALHO L F , SAMPAIO L D H , et al . Network anomaly detection system using genetic algorithm and fuzzy logic [J ] . Expert Systems with Applications , 2018 , 92 : 390 - 402 .
WANG T , CAI X , NITHYANAND R , et al . Effective attacks and provable defenses for website fingerprinting [C ] // Proceedings of the 23rd USENIX Conference on Security Symposium . Berkeley : USENIX Association , 2014 : 143 - 157 .
ZHAO S C , LI W , ZIA T , et al . A dimension reduction model and classifier for anomaly-based intrusion detection in Internet of things [C ] // Proceedings of the 2017 IEEE 15th Intl Conf on Dependable, Autonomic and Secure Computing, 15th Intl Conf on Pervasive Intelligence and Computing, 3rd Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress (DASC/PiCom/DataCom/CyberSciTech) . Piscataway : IEEE Press , 2017 : 836 - 843 .
MSADEK N , SOUA R , ENGEL T . IoT device fingerprinting: machine learning based encrypted traffic analysis [C ] // Proceedings of the 2019 IEEE Wireless Communications and Networking Conference (WCNC) . Piscataway : IEEE Press , 2019 : 1 - 8 .
MIRSKY Y , DOITSHMAN T , ELOVICI Y , et al . Kitsune: an ensemble of autoencoders for online network intrusion detection [C ] // Proceedings 2018 Network and Distributed System Security Symposium . Reston : Internet Society , 2018 .
DAVID J , THOMAS C . DDoS attack detection using fast entropy approach on flow-based network traffic [J ] . Procedia Computer Science , 2015 , 50 : 30 - 36 .
ROOSMALEN J V , VRANKEN H , EEKELEN M V . Applying deep learning on packet flows for botnet detection [C ] // Proceedings of the 33rd Annual ACM Symposium on Applied Computing . New York : ACM Press , 2018 : 1629 - 1636 .
RADFORD B J , APOLONIO L M , TRIAS A J , et al . Network traffic anomaly detection using recurrent neural networks [J ] . arXiv Preprint , arXiv: 1803.10769 , 2018 .
LIU Y X , LI Z , PAN S R , et al . Anomaly detection on attributed networks via contrastive self-supervised learning [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2022 , 33 ( 6 ): 2378 - 2392 .
DIALLO A F , PATRAS P . Adaptive clustering-based malicious traffic classification at the network edge [C ] // Proceedings of the IEEE INFOCOM 2021-IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2021 : 1 - 10 .
MA X B , QU J , LI J F , et al . Inferring hidden IoT devices and user interactions via spatial-temporal traffic fingerprinting [J ] . IEEE/ACM Transactions on Networking , 2022 , 30 ( 1 ): 394 - 408 .
PERDISCI R , PAPASTERGIOU T , ALRAWI O , et al . IoTFinder: efficient large-scale identification of IoT devices via passive DNS traffic analysis [C ] // Proceedings of the 2020 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2020 : 474 - 489 .
MAITI R R , SIBY S , SRIDHARAN R , et al . Link-layer device type classification on encrypted wireless traffic with COTS radios [C ] // European Symposium on Research in Computer Security . Berlin : Springer , 2017 : 247 - 264 .
SHEN M , LIU Y T , ZHU L H , et al . Fine-grained webpage fingerprinting using only packet length information of encrypted traffic [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 2046 - 2059 .
LI J F , ZHOU H , WU S H , et al . FOAP: fine-grained open-world android app fingerprinting [C ] // 31st USENIX Security Symposium (USENIX Security 22) . Berkeley : USENIX Association , 2022 : 1579 - 1596 .
QU J , MA X B , LI J F , et al . An input-agnostic hierarchical deep learning framework for traffic fingerprinting [C ] // 32nd USENIX Security Symposium . Berkeley : USENIX Association , 2023 : 589 - 606 .
SOHI S M , SEIFERT J P , GANJI F . RNNIDS: enhancing network intrusion detection systems through deep learning [J ] . Computers & Security , 2021 , 102 : 102151 .
LOTFOLLAHI M , JAFARI SIAVOSHANI M , SHIRALI HOSSEIN ZADE R , et al . Deep packet: a novel approach for encrypted traffic classification using deep learning [J ] . Soft Computing , 2020 , 24 ( 3 ): 1999 - 2012 .
MARÍN G , CAASAS P , CAPDEHOURAT G . DeepMAL-deep learning models for malware traffic detection and classification [C ] // Data Science-Analytics and Applications: Proceedings of the 3rd International Data Science Conference-iDSC2020 . Berlin : Springer , 2021 : 105 - 112 .
王勇 , 周慧怡 , 俸皓 , 等 . 基于深度卷积神经网络的网络流量分类方法 [J ] . 通信学报 , 2018 , 39 ( 1 ): 14 - 23 .
WANG Y , ZHOU H Y , FENG H , et al . Network traffic classification method basing on CNN [J ] . Journal on Communications , 2018 , 39 ( 1 ): 14 - 23 .
MAXWELL P , ALHAJJAR E , BASTIAN N D . Intelligent feature engineering for cybersecurity [C ] // Proceedings of the 2019 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2019 : 5005 - 5011 .
FERNANDES G , CARVALHO L F , RODRIGUES J J P C , et al . Network anomaly detection using IP flows with principal component analysis and ant colony optimization [J ] . Journal of Network and Computer Applications , 2016 , 64 : 1 - 11 .
BERISHA V , KRANTSEVICH C , HAHN P R , et al . Digital medicine and the curse of dimensionality [J ] . NPJ Digital Medicine , 2021 , 4 ( 1 ): 153 .
YANG J , CHEN X , CHEN S W , et al . Conditional variational auto-encoder and extreme value theory aided two-stage learning approach for intelligent fine-grained known/unknown intrusion detection [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 3538 - 3553 .
PSATHAS A P , ILIADIS L , PAPALEONIDAS A , et al . COREM2 project: a beginning to end approach for cyber intrusion detection [J ] . Neural Computing and Applications , 2022 , 34 ( 22 ): 19565 - 19584 .
FU C P , LI Q , SHEN M , et al . Frequency domain feature based robust malicious traffic detection [J ] . IEEE/ACM Transactions on Networking , 2023 , 31 ( 1 ): 452 - 467 .
WANG T Z , XIE X H , WANG W D , et al . NetMamba: efficient network traffic classification via pre-training unidirectional mamba [J ] . arXiv Preprint , arXiv: 2405.11449 , 2024 .
XU K , ZHANG X X , WANG Y , et al . Self-supervised learning malware traffic classification based on masked autoencoder [J ] . IEEE Internet of Things Journal , 2024 , 11 ( 10 ): 17330 - 17340 .
SUN P F , LIU P J , LI Q , et al . DL-IDS: extracting features using CNN-LSTM hybrid network for intrusion detection system [J ] . Security and Communication Networks , 2020 , 2020 : 8890306 .
KANNA P R , SANTHI P . Unified deep learning approach for efficient intrusion detection system using integrated spatial-temporal features [J ] . Knowledge-Based Systems , 2021 , 226 : 107132 .
KANNA P R , SANTHI P . Hybrid intrusion detection using MapReduce based black widow optimized convolutional long short-term memory neural networks [J ] . Expert Systems with Applications , 2022 , 194 : 116545 .
LIN X J , XIONG G , GOU G P , et al . ET-BERT: a contextualized datagram representation with pre-training transformers for encrypted traffic classification [C ] // Proceedings of the ACM Web Conference . New York : ACM Press , 2022 : 633 - 642 .
ZHANG H Z , YU L , XIAO X , et al . TFE-GNN: a temporal fusion encoder using graph neural networks for fine-grained encrypted traffic classification [C ] // Proceedings of the ACM Web Conference 2023 . New York : ACM Press , 2023 : 2066 - 2075 .
ZHAO R J , ZHAN M W , DENG X W , et al . Yet another traffic classifier: a masked autoencoder based traffic transformer with multi-level flow representation [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2023 , 37 ( 4 ): 5420 - 5427 .
XU X B , PANG F L , RAN Y Y , et al . An indoor mobile robot positioning algorithm based on adaptive federated Kalman filter [J ] . IEEE Sensors Journal , 2021 , 21 ( 20 ): 23098 - 23107 .
JANG J G , KANG U . D-tucker: fast and memory-efficient tucker decomposition for dense tensors [C ] // Proceedings of the 2020 IEEE 36th International Conference on Data Engineering (ICDE) . Piscataway : IEEE Press , 2020 : 1850 - 1853 .
ZHOU S , ERFANI S , BAILEY J . Online CP decomposition for sparse tensors [C ] // Proceedings of the 2018 IEEE International Conference on Data Mining (ICDM) . Piscataway : IEEE Press , 2018 : 1458 - 1463 .
LIU Z X , CHEN S M . Pea hash: a performant extendible adaptive hashing index [J ] . Proceedings of the ACM on Management of Data , 2023 , 1 ( 1 ): 1 - 25 .
史加荣 , 王丹 , 尚凡华 , 等 . 随机梯度下降算法研究进展 [J ] . 自动化学报 , 2021 , 47 ( 9 ): 2103 - 2119 .
SHI J R , WANG D , SHANG F H , et al . Research advances on stochastic gradient descent algorithms [J ] . Acta Automatica Sinica , 2021 , 47 ( 9 ): 2103 - 2119 .
RIBEIRO M T , SINGH S , GUESTRIN C . “Why should I trust you?”: explaining the predictions of any classifier [C ] // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . New York : ACM Press , 2016 : 1135 - 1144 .
GUO X S , ZHANG Q M , JIANG J Y , et al . Towards explainable traffic flow prediction with large language models [J ] . arXiv Preprint , arXiv: 2404.02937 , 2024 .
HAN D Q , WANG Z L , ZHONG Y , et al . Evaluating and improving adversarial robustness of machine learning-based network intrusion detectors [J ] . IEEE Journal on Selected Areas in Communications , 2021 , 39 ( 8 ): 2632 - 2647 .
CUI X M , APARCEDO A , JANG Y K , et al . On the robustness of large multimodal models against image adversarial attacks [C ] // Proceedings of the 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2024 : 24625 - 24634 .
0
浏览量
11
下载量
0
CSCD
关联资源
相关文章
相关作者
相关机构