基于无监督学习的软件定义网络异常流量检测技术

Detection Technology for Software-defined Network Abnormal Traffic Based on Unsupervised Learning

软件定义网络中存在多种不同类型的异常流量,高维数的异常流量需要大量的数据进行训练和检测,异常流量难以被准确提取,导致软件定义网络异常流量难以精准检测。为此,该研究基于无监督学习的软件定义网络异常流量检测技术,提升软件定义网络的运行安全性。利用无监督学习方法中的自编码器方法,通过压缩网络和检测网络2部分检测软件定义网络异常流量。压缩网络部分采用收缩自编码技术,通过调节重构误差的损失函数,对软件定义网络流量特征实施降维处理;将降维处理后的软件定义网络流量特征,输入条件生成对抗网络-长短时记忆网络模型中,该模型利用生成器生成软件定义网络流量样本,作为判别器训练的依据,利用完成训练的判别器,输出软件定义网络异常流量检测结果。实验结果表明,该方法在迭代次数接近150次时,重构误差稳定至0.01左右,该方法能够有效检测软件定义网络受到不同类型的攻击造成的流量异常情况,及时发出告警,异常流量检测精度为98.98%。

There are many different types of abnormal traffic in software-defined network,high-dimensional abnormal traffic needs a lot of data for training and detection,abnormal traffic is difficult to be extracted accurately,so it is difficult to accurately detect abnormal traffic in software-defined network.For this reason,the software-defined network abnormal traffic detection technology based on unsupervised learning is studied to improve the operational security of the software-defined network.By using the self-encoder method of unsupervised learning method,the abnormal network traffic defined by software is detected by compressing the network and detecting the network.The shrinking self-coding technology is adopted in the compressed network part,and the dimensionality reduction of the software-defined network traffic characteristics is implemented by adjusting the loss function of the reconstruction error.After the dimensionality reduction,the software defines the network traffic characteristics,and the input condition generates the countermeasure network-short-term memory network model.The model uses the generator to generate the software-defined network traffic sample as the basis for the discriminator training.The discriminator that completes the training is used to output the abnormal network traffic detection results of the software definition.The experimental results show that when the number of iterations is close to 150,the reconstruction error is stable to about 0.01.This method can effectively detect the traffic anomalies caused by different types of attacks on the software-defined network,and issue alarms in time,so that the accuracy of abnormal traffic detection is 98.98%.