基于多维度融合注意力的舰船网络异常流量检测

Abnormal Traffic Detection for Ship Network Based on Multi-scale Fusion Attention

舰船网络通信系统的正常运行是保障舰船安全航行的基础。针对现有舰船网络通信系统访问流量异常检测模型检测精度不高和实时性不强的问题,提出一种基于多维度融合注意力的轻量级舰船网络服务器异常流量检测算法。利用Bidirectional Encoder Representation from Transformers(BERT)作为特征编码器,将捕获的流量数据包映射到深度特征空间;利用深度可分离卷积(Depth-Separable Convolutional, DSC)网络和长短时记忆(Long Short Term Memory, LSTM)神经网络捕获深度编码特征的空间编码特征和时间维度的编码特征;提出一种多维度融合注意力模块,将空间和时间维度的编码特征进行特征融合;利用多维度融合特征进行正常与异常流量的分类。通过在自建的舰船流量异常数据集上进行测试,结果表明所提出模型能够有效检测出舰船网络通信系统的异常访问流量,在保持检测精度的同时,降低了检测时间开销。

The normal operation of ship network communication system is the basis for the safe navigation of the ship.To address the problems of low detection accuracy and weak real-time performance for existing access traffic anomaly detection models of ship network communication system,an abnormal traffic detection algorithm for lightweight ship network server based on multi-scale fused attention is proposed.Firstly,the captured traffic packets are mapped to a deep feature space using Bidirectional Encoder Representation from Transformers(BERT).The spatial coding features and temporal-dimension coding features of the depth coding features are then captured using a Depth-Separable Convolutional(DSC)network and a Long Short Term Memory(LSTM)neural network.Secondly,a multi-scale fusion attention module is proposed to fuse the spatial and temporal-dimension encoding features.Finally,the classification of normal and abnormal traffic is realized using multi-scale fusion features.By testing on a self-built ship traffic dataset,the results show that the proposed model can effectively detect the abnormal access traffic of ship network systems,reducing the detection time overhead while maintaining the detection accuracy.