基于DAPA的卷积神经网络Web异常流量检测方法

A convolutional neural network Web abnormal flow detection method based on DAPA

针对Web攻击流量检测问题,提出一种基于动态自适应池化算法(Dynamic Adaptive Pooling Algorithm,DAPA)的卷积神经网络模型。首先将数据集中每一条请求流量进行剪裁、对齐、补足等操作,生成一系列50×150的矩阵数据A作为输入,然后搭建基于动态自适应的卷积神经网络模型去进行异常流量检测,使之可以根据特征图的不同,动态地调整池化过程,在网络结构中添加Dropout层来解决流量特征提取过程中的过拟合问题。实验表明,该方法比未使用动态自适应池化的方式精确度提升了1.2%,损失值降低了2.6%,过拟合问题也得到了解决。

Aiming at the problem of Web attack traffic detection,a convolutional neural network model based on Dynamic Adaptive Pooling Algorithm(DAPA)was proposed.Firstly,each request traffic in the data set is trimmed,aligned,and complemented to generate a series of 50×150 matrix data A as input.Then,a dynamic adaptive convolutional neural network model built to detect abnormal traffic can adjust the pooling process dynamically according to different feature maps,and a Dropout layer can be added to the network structure to solve the problem of over-fitting in the flow feature extraction process.Experiments show that the method has an accuracy improvement of 1.2%,a loss value of 2.6%,and an over-fitting problem is solved compared with the method without using dynamic adaptive pooling.