No abstract

Complex and multidimensional network traffic features have potential redundancy. When traditional detection methods are used for training samples, the detection accuracy of the supervised classification model is affected due to small data samples. Therefore, a method based on generative adversarial networks (GANs) and feature optimization is proposed. First, the feature correlation and redundancy are analyzed by the potential redundancy of network traffic. The feature optimization selection method of collaborative learning automata is proposed. Second, the confrontation interactive training principle of the generative confrontation network is adapted, in which a model of the generative confrontation network is proposed to solve the problem that small training label samples. Third, the interdomain distance is minimized by using GAN and the multiple kernel variant of maximum mean discrepancy (MK-MMD). The shared features between the source domain and target domain distribution are learned by applying the information between GAN confrontation training and classification network supervision training, improving the detection accuracy. Forth, random noise data and original training label samples are mixed to form a new training set. The accuracy is further improved by adopting generative models to continuously generate samples. The final classification results are output by the 16-dimensional Softmax classifier. The method has a small loss rate when the datasets are used to train by the experimental analysis of algorithm parameters and simulation data. The model optimized by MK-MMD has strong generalization ability. The average detection accuracy rates are 91.673% (two-classification) and 91.480% (multiclassification) by comparing machine learning and other shallow neural networks, and are the highest values among the compared methods. Moreover, the effectiveness and superiority of the proposed method are verified to be the best by comparing the recall rate, false positive rate (FPR), F-measure, AUC. When the interference of other samples are mixed, the proposed method is also robust.

Detecting various attacks and abnormal traffic in the network is extremely important to network security. Existing detection models used massive amounts of data to complete abnormal traffic detection. However, few-shot attack samples can only be intercepted in certain special scenarios. In addition, the discrimination of traffic attributes will also be affected by the change of feature attitude. But the traditional neural network model cannot detect this kind of attitude change. Therefore, the accuracy and efficiency of few-shot sample abnormal traffic detection are very low. In this paper, we proposed a few-shot abnormal network traffic detection method. It was composed of the multi-scale Deep-CapsNet and adversarial reconstruction. First, we designed an improved EM vector clustering of the Deep-CapsNet. The attitude transformation matrix was used to complete the prediction from low-level to high-level features. Second, a multi-scale convolutional capsule was designed to optimize the Deep-CapsNet. Third, an adversarial reconstruction classification network (ARCN) was proposed. The supervised source data classification and the unsupervised target data reconstruction were achieved. Moreover, we proposed an adversarial training strategy, which alleviated the noise interference during reconstruction. Fourth, the few-shot sample classification were obtained by combining multi-scale Deep-CapsNet and adversarial reconstruction. The ICSX2012 and CICIDS2017 datasets were used to verify the performance. The experimental results show that our method has better training performance. Moreover, it has the highest accuracy in two-classification and multi-classification. Especially it has good anti-noise performance and short running time, which can be used for real-time few-shot abnormal network traffic detection.

No abstract

No abstract