基于多模型并行融合网络的恶意流量检测方法

Malicious traffic detection method based on multi-model parallel fusion network

针对单一串行深度学习检测模型提取流量特征时无法完整反映原始流量信息,且恶意流量识别精度低的问题,设计多模型并行融合网络,提出一种基于多模型并行融合网络的恶意流量检测方法。所提方法采用并行方式,融合一维卷积神经网络(1D-CNN)与双向长短期记忆(Bi-LSTM)网络进行特征提取和流量识别,各条支路均直接面向原始流量,同时提取流量的空间特征与时序特征,采用共同的全连接层进行特征融合,可更精准地反映原始流量信息并有效提高恶意流量的识别准确率。在开源NSL-KDD数据集上的实验结果表明,所提方法恶意流量检测的特征提取能力、鲁棒性以及在线学习能力等方面均表现了优越的性能。

A malicious traffic detection method based on a multi-model parallel fusion network was proposed to address the issue of incomplete reflection of original traffic information and poor accuracy in identifying malicious traffic when using a single sequential deep learning detection model.The parallel approach was used to combine one-Dimensional Convolutional Neural Network(1D-CNN)and Bi-directional Long Short-Term Memory(Bi-LSTM)network for feature extraction and traffic recognition.Each branch directly facing to the original traffic,both spatial and temporal features were extracted.A common fully connected layer was used for feature fusion,which could more accurately reflect the original traffic information and effectively improved the accuracy of malicious traffic identification.Experimental results on the open-source NSL-KDD dataset demonstrate the superior performance of the proposed method in terms of feature extraction capability,robustness,and online learning ability for malicious traffic detection.