Network traffic anomaly detection method based on multi-scale characteristic

Xueyuan DUAN; Yu FU; Kun WANG; Taotao LIU; Bin LI

doi:10.11959/j.issn.1000-436x.2022195

您当前的位置：

首页 >

文章列表页 >

Network traffic anomaly detection method based on multi-scale characteristic

Papers | 更新时间：2024-06-05

- Network traffic anomaly detection method based on multi-scale characteristic
- Journal on Communications Vol. 43, Issue 10, Pages: 65-76(2022)
- 作者机构：
  
  1. 海军工程大学信息安全系，湖北武汉 430033
  2. 信阳师范学院计算机与信息技术学院，河南信阳 464000
  3. 信阳师范学院河南省教育大数据分析与应用重点实验室，河南信阳 464000
  4. 信阳职业技术学院数学与信息工程学院，河南信阳 464000
- 作者简介：
- 基金信息：
  
  The National Key Research and Development Program of China(2018YFB0804104)
- DOI：10.11959/j.issn.1000-436x.2022195
  CLC： TP391
- Online First：2022-10，
  
  Published：25 October 2022
- 稿件说明：
移动端阅览
Xueyuan DUAN, Yu FU, Kun WANG, et al. Network traffic anomaly detection method based on multi-scale characteristic[J]. Journal on Communications, 2022, 43(10): 65-76.
DOI：

Xueyuan DUAN, Yu FU, Kun WANG, et al. Network traffic anomaly detection method based on multi-scale characteristic[J]. Journal on Communications, 2022, 43(10): 65-76. DOI： 10.11959/j.issn.1000-436x.2022195.

摘要

摘要：针对传统的网络流量异常检测方法大都只关注流量数据的细粒度特征，对多尺度特征信息利用不充分，可能导致异常检测结果准确率不高的问题，提出了一种基于多尺度特征的网络流量异常检测方法。使用多个不同尺度的滑动窗口将原始流量划分为多个观察跨度的子序列，利用小波变换技术重构各个子序列的多层级序列，链式 SAE 通过特征空间映射生成多层级重构序列，各层级的分类器根据重构序列的误差进行异常的初步判定，采用加权投票策略对各层级的初步判定结果进行汇总，形成最终结果判定。实验结果表明，所提方法可有效挖掘网络流量的多尺度特征信息，对异常流量的检测性能较传统方法有明显提升。

Abstract

Aiming at the problem that most of the traditional network traffic anomaly detection methods only pay attention to the fine-grained features of traffic data

and make insufficient use of multi-scale feature information

which may lead to low accuracy of anomaly detection results

a network traffic anomaly detection method based on multi-scale features was proposed.The original traffic was divided into sub-sequences with multiple observation spans by using multiple sliding windows of different scales

and the multi-level sequences of each sub-sequence were reconstructed by wavelet transform technology.Multi-level reconstructed sequences were generated by Chain SAE through feature space mapping

and a preliminary judgment of abnormality was made by the classifiers of each level according to the errors of the reconstructed sequences.The weighted voting strategy was adopted to summarize the preliminary judgment results of each level to form the final result judgment.Experimental results show that the proposed method can effectively mine the multi-scale feature information of network traffic

and the detection performance of abnormal traffic is obviously improved compared with traditional methods.

关键词

Keywords

references

YUAN X Y , HE P , ZHU Q L , et al . Adversarial examples:attacks and defenses for deep learning [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2019 , 30 ( 9 ): 2805 - 2824 .

张成磊 , 付玉龙 , 李晖 , 等 . 6G 网络安全场景分析及安全模型研究 [J ] . 网络与信息安全学报 , 2021 , 7 ( 1 ): 28 - 45 .

ZHANG C L , FU Y L , LI H , et al . Research on security scenarios and security models for 6G networking [J ] . Chinese Journal of Network and Information Security , 2021 , 7 ( 1 ): 28 - 45 .

AL-SANJARY O I , ROSLAN M A B , HELMI R A A , et al . Comparison and detection analysis of network traffic datasets using K-means clustering algorithm [J ] . Journal of Information ＆ Knowledge Management , 2020 , 19 ( 3 ): 2050026 .

PARMAR N , SHARMA A , JAIN H , et al . Email spam detection using nave Bayes and particle swarm optimization [J ] . 2020 , 6 ( 10 ): 367 - 373 .

李洪成 , 吴晓平 , 姜洪海 . 基于改进聚类分析的网络流量异常检测方法 [J ] . 网络与信息安全学报 , 2015 , 1 ( 1 ): 66 - 71 .

LI H C , WU X P , JIANG H H . Traffic anomaly detection method in networks based on improved clustering algorithm [J ] . Chinese Journal of Network and Information Security , 2015 , 1 ( 1 ): 66 - 71 .

VIJAYANAND R , DEVARAJ D , KANNAPIRAN B . Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid [C ] // Proceedings of 4th International Conference on Advanced Computing and Communication Systems . Piscataway:IEEE Press , 2017 : 1 - 7 .

DA T , QU Y R , PRASANNA V K . Accelerating decision tree based traffic classification on FPGA and multicore platforms [J ] . IEEE Transactions on Parallel and Distributed Systems , 2017 , 28 ( 11 ): 3046 - 3059 .

JAIN M , KAUR G , SAXENA V . A K-Means clustering and SVM based hybrid concept drift detection technique for network anomaly detection [J ] . Expert Systems with Applications , 2022 ,193:116510.

KHAN M , WANG H Z , RIAZ A , et al . Bidirectional LSTM-RNNbased hybrid deep learning frameworks for univariate time series classification [J ] . The Journal of Supercomputing , 2021 , 77 ( 7 ): 7021 - 7045 .

GOODFELLOW I , BENGIO Y , et al . Deep learning [M ] . Cambridge : MIT Press , 2016 .

GOODFELLOW I J , POUGET-ABADIE J , MIRZA M , et al . Generative adversarial nets [C ] // Proceedings of the 27th International Conference on Neural Information Processing Systems . Massachusetts:MIT Press , 2014 : 2672 - 2680 .

KINGMA D P , WELLING M . Auto-encoding variational Bayes [J ] . Statistics , 2014 , 10 : 1 - 14 .

BRYNIELSSON J , SHARMA R . Detectability of low-rate HTTP server DoS attacks using spectral analysis [C ] // Proceedings of IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining . Piscataway:IEEE Press , 2015 : 954 - 961 .

何炎祥 , 曹强 , 刘陶 , 等 . 一种基于小波特征提取的低速率DoS检测方法 [J ] . 软件学报 , 2009 , 20 ( 4 ): 930 - 941 .

HE Y X , CAO Q , LIU T , et al . A low-rate DoS detection method based on feature extraction using wavelet transform [J ] . Journal of Software , 2009 , 20 ( 4 ): 930 - 941 .

CHENG M , LI Q , LV J M , et al . Multi-scale LSTM model for BGP anomaly classification [J ] . IEEE Transactions on Services Computing , 2021 , 14 ( 3 ): 765 - 778 .

WANG J Y , WANG Z , LI J F , et al . Multilevel wavelet decomposition network for interpretable time series analysis [C ] // Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery ＆ Data Mining . New York:ACM Press , 2018 : 2437 - 2446 .

FOULADI R F , ERMIŞ O , ANARIM E . A DDoS attack detection and countermeasure scheme based on DWT and auto-encoder neural network for SDN [J ] . Computer Networks , 2022 ,214:109140.

ALBAHAR M A . Recurrent neural network model based on a new regularization technique for real-time intrusion detection in SDN environments [J ] . Security and Communication Networks , 2019 , 2019 : 1 - 9 .

PEI J M , ZHONG K Y , JAN M A , et al . Personalized federated learning framework for network traffic anomaly detection [J ] . Computer Networks , 2022 ,209:108906.

ZONG B , SONG Q , MIN M R , et al . Deep autoencoding gaussian mixture model for unsupervised anomaly detection [C ] // Proceedings of International Conference on Learning Representations . Vancouver:ICLR Press , 2018 : 1 - 19 .

YANG D H , HWANG M . Unsupervised and ensemble-based anomaly detection method for network security [C ] // Proceedings of14th International Conference on Knowledge and Smart Technology . Piscataway:IEEE Press , 2022 : 75 - 79 .

GEIGER A , LIU D Y , ALNEGHEIMISH S , et al . TadGAN:time series anomaly detection using generative adversarial networks [C ] // Proceedings of IEEE International Conference on Big Data (Big Data) . Piscataway:IEEE Press , 2020 : 33 - 43 .

PATIL R , BIRADAR R , RAVI V , et al . Network traffic anomaly detection using PCA and BiGAN [J ] . Internet Technology Letters , 2022 , 5 ( 1 ): e235 .

邹福泰 , 谭越 , 王林 , 等 . 基于生成对抗网络的僵尸网络检测 [J ] . 通信学报 , 2021 , 42 ( 7 ): 95 - 106 .

ZOU F T , TAN Y , WANG L , et al . Botnet detection based on generative adversarial network [J ] . Journal on Communications , 2021 , 42 ( 7 ): 95 - 106 .

CHEN X H , DENG L W , HUANG F T , et al . DAEMON:unsupervised anomaly detection and interpretation for multivariate time series [C ] // Proceedings of IEEE 37th International Conference on Data Engineering . Piscataway:IEEE Press , 2021 : 2225 - 2230 .

麻文刚 , 张亚东 , 郭进 . 基于LSTM与改进残差网络优化的异常流量检测方法 [J ] . 通信学报 , 2021 , 42 ( 5 ): 23 - 40 .

MA W G , ZHANG Y D , GUO J . Abnormal traffic detection method based on LSTM and improved residual neural network optimization [J ] . Journal on Communications , 2021 , 42 ( 5 ): 23 - 40 .

CHOUHAN N , KHAN A , KHAN H U R . Network anomaly detection using channel boosted and residual learning based deep convolutional neural network [J ] . Applied Soft Computing , 2019 ,83:105612.

YANG S , . Anomaly traffic detection based on LSTM [C ] // Proceedings of IEEE 10th Joint International Information Technology and Artificial Intelligence Conference . Piscataway:IEEE Press , 2022 : 667 - 670 .

ULLAH I , MAHMOUD Q H . Design and development of RNN anomaly detection model for IoT networks [J ] . IEEE Access , 2022 , 10 : 62722 - 62750 .

SUGIARTAWAN P , PULUNGAN R , KARTIKA A . Prediction by a hybrid of wavelet transform and long-short-term-memory neural network [J ] . International Journal of Advanced Computer Science and Applications , 2017 , 8 ( 2 ): 326 - 332 .

CHEN J L , LI Z P , PAN J , et al . Wavelet transform based on inner product in fault diagnosis of rotating machinery:a review [J ] . Mechanical Systems and Signal Processing , 2016 , 70/71 : 1 - 35 .

Views

1321

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on traffic representation in network anomaly detection

NMF-NAD:detecting network-wide traffic anomaly based on NMF

Method of detecting network anomaly on multi-time-scale

Review of unsupervised anomaly detection techniques for medical imaging

Anomaly detection method for intelligent UAV networks based on collaborative adversarial enhanced generative model

Related Author

SUN Jianwen

ZHANG Bin

CHANG Heyu

Xiang-lin WEI

Ming CHEN

Guo-min ZHANG

Jian-jun HUANG

WANG Feng-yu1

Related Institution

Cryptography Engineering Institute, Information Engineering University

Institute of Command Automation,PLA University of Science and Technology

Institute of Computing Technology,Chinese Academy of Sciences

School of Computer Science and Engineering, Xi’an University of Technology

Shaanxi Key Laboratory for Network Computing and Security Technology

AI问答

⁰