融合生成式神经网络和深度神经网络的流量异常检测

Traffic Anomaly Detection Based on Fusing Generative Neural Network and Deep Neural Network

针对网络攻击隐蔽性和动态多变的特征,提出一种融合生成式神经网络和深度神经网络的流量异常检测方法,该方法针对网络流量数据不平衡问题,采用生成式神经网络实现样本库的扩充,在此基础上,采用Dense Net实现网络流量多层次特征的提取,该方法通过加强不同层次特征的传递,实现不同层次特征的融合,为网络流量异常识别提供基础。实验表明,本文提出的方法在准确率、召回率、漏检率以及平均处理时间均优于单纯使用CNN或LSTM的方法,因此,本文方法能够有效检测网络异常流量,具有一定的可用性。

In view of the covert and dynamic characteristics of network attacks, a traffic anomaly detection method is proposed by fusing the generative neural network(GNN) and deep neural network(DNN). This method aims at the imbalance issue of network traffic data and uses the GNN to expand the sample database. On this basis, Dense Net is used to realize the extraction of multi-level features of network traffic. The fusion of different-level features is realized by strengthening the transmission of different-level features, which provides the basis for network traffic identification. The experiments show that the proposed method is better than the methods of simply using CNN and LTSM in terms of accuracy, recall rate, missed detection rate and time delay. Therefore, the proposed method can effectively detect abnormal network traffic and has certain usability.