In order to solve the problem that existing multivariate grey incidence models cannot be applied to time series on different scales, a new model is proposed based on spatial pyramid pooling.Firstly, local features of ...In order to solve the problem that existing multivariate grey incidence models cannot be applied to time series on different scales, a new model is proposed based on spatial pyramid pooling.Firstly, local features of multivariate time series on different scales are pooled and aggregated by spatial pyramid pooling to construct n levels feature pooling matrices on the same scale. Secondly,Deng's multivariate grey incidence model is introduced to measure the degree of incidence between feature pooling matrices at each level. Thirdly, grey incidence degrees at each level are integrated into a global incidence degree. Finally, the performance of the proposed model is verified on two data sets compared with a variety of algorithms. The results illustrate that the proposed model is more effective and efficient than other similarity measure algorithms.展开更多
Due to the rapid evolution of Advanced Persistent Threats(APTs)attacks,the emergence of new and rare attack samples,and even those never seen before,make it challenging for traditional rule-based detection methods to ...Due to the rapid evolution of Advanced Persistent Threats(APTs)attacks,the emergence of new and rare attack samples,and even those never seen before,make it challenging for traditional rule-based detection methods to extract universal rules for effective detection.With the progress in techniques such as transfer learning and meta-learning,few-shot network attack detection has progressed.However,challenges in few-shot network attack detection arise from the inability of time sequence flow features to adapt to the fixed length input requirement of deep learning,difficulties in capturing rich information from original flow in the case of insufficient samples,and the challenge of high-level abstract representation.To address these challenges,a few-shot network attack detection based on NFHP(Network Flow Holographic Picture)-RN(ResNet)is proposed.Specifically,leveraging inherent properties of images such as translation invariance,rotation invariance,scale invariance,and illumination invariance,network attack traffic features and contextual relationships are intuitively represented in NFHP.In addition,an improved RN network model is employed for high-level abstract feature extraction,ensuring that the extracted high-level abstract features maintain the detailed characteristics of the original traffic behavior,regardless of changes in background traffic.Finally,a meta-learning model based on the self-attention mechanism is constructed,achieving the detection of novel APT few-shot network attacks through the empirical generalization of high-level abstract feature representations of known-class network attack behaviors.Experimental results demonstrate that the proposed method can learn high-level abstract features of network attacks across different traffic detail granularities.Comparedwith state-of-the-artmethods,it achieves favorable accuracy,precision,recall,and F1 scores for the identification of unknown-class network attacks through cross-validation onmultiple datasets.展开更多
基金supported by the National Natural Science Foundation of China(71401052)the Fundamental Research Funds for the Central Universities(2019B19514)。
文摘In order to solve the problem that existing multivariate grey incidence models cannot be applied to time series on different scales, a new model is proposed based on spatial pyramid pooling.Firstly, local features of multivariate time series on different scales are pooled and aggregated by spatial pyramid pooling to construct n levels feature pooling matrices on the same scale. Secondly,Deng's multivariate grey incidence model is introduced to measure the degree of incidence between feature pooling matrices at each level. Thirdly, grey incidence degrees at each level are integrated into a global incidence degree. Finally, the performance of the proposed model is verified on two data sets compared with a variety of algorithms. The results illustrate that the proposed model is more effective and efficient than other similarity measure algorithms.
基金supported by the International Research Center of Big Data for Sustainable Development Goals [grant number CBAS2022GSP01]the National Natural Science Foundation of China [grant numbers 42276203 and 42030406]+1 种基金the Natural Science Foundation of Shandong Province [grant number ZR2021MD001]the Laoshan Laboratory [grant number LSKJ202204302].
基金supported by the National Natural Science Foundation of China(Nos.U19A208162202320)+2 种基金the Fundamental Research Funds for the Central Universities(No.SCU2023D008)the Science and Engineering Connotation Development Project of Sichuan University(No.2020SCUNG129)the Key Laboratory of Data Protection and Intelligent Management(Sichuan University),Ministry of Education.
文摘Due to the rapid evolution of Advanced Persistent Threats(APTs)attacks,the emergence of new and rare attack samples,and even those never seen before,make it challenging for traditional rule-based detection methods to extract universal rules for effective detection.With the progress in techniques such as transfer learning and meta-learning,few-shot network attack detection has progressed.However,challenges in few-shot network attack detection arise from the inability of time sequence flow features to adapt to the fixed length input requirement of deep learning,difficulties in capturing rich information from original flow in the case of insufficient samples,and the challenge of high-level abstract representation.To address these challenges,a few-shot network attack detection based on NFHP(Network Flow Holographic Picture)-RN(ResNet)is proposed.Specifically,leveraging inherent properties of images such as translation invariance,rotation invariance,scale invariance,and illumination invariance,network attack traffic features and contextual relationships are intuitively represented in NFHP.In addition,an improved RN network model is employed for high-level abstract feature extraction,ensuring that the extracted high-level abstract features maintain the detailed characteristics of the original traffic behavior,regardless of changes in background traffic.Finally,a meta-learning model based on the self-attention mechanism is constructed,achieving the detection of novel APT few-shot network attacks through the empirical generalization of high-level abstract feature representations of known-class network attack behaviors.Experimental results demonstrate that the proposed method can learn high-level abstract features of network attacks across different traffic detail granularities.Comparedwith state-of-the-artmethods,it achieves favorable accuracy,precision,recall,and F1 scores for the identification of unknown-class network attacks through cross-validation onmultiple datasets.
