An Improved Parallel Network Traffic Anomaly Detection Method Based on Bagging and GRU

Tao, Xiaoling; Peng, Yang; Zhao, Feng; Wang, Sufang; Liu, Ziyi

doi:10.1007/978-3-030-59016-1_35

Cited by 11 publications

(6 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…At the same time, it can also effectively suppress or eliminate complex environments under the influence of noise. It has certain research prospects in complex neural networks [27,28], traffic prediction models [29][30][31], and network security [32][33][34].…”

Section: Eemd Algorithmmentioning

confidence: 99%

Retracted: Anomaly detection with ensemble empirical mode decomposition and approximate entropy for quick user datagram protocol internet connection‐based distributed Blockchain systems

Cao

et al. 2023

IET Software

View full text Add to dashboard Cite

With the vigorous development of mobile Internet and Blockchain, the rapid and secure interaction of high-frequency data in the era of data explosion has gradually become an urgent need for people. Quick User Datagram Protocol Internet Connection Protocol (QUIC) can be perfectly integrated into the Blockchain due to its low latency and high security, providing a safe and reliable transmission service for the Blockchain system. However, QUIC-based distributed Blockchain systems are vulnerable to cyberattacks due to asymmetric encryption and timestamp, which seriously impacts security and fairness. Therefore, based on the self-similarity of QUIC network traffic, this study proposes an anomaly detection model for QUIC network traffic based on Ensemble Empirical Mode Decomposition and Approximate Entropy. The model obtains several intrinsic mode functions and a residual term by decomposing the network traffic, introducing Approximate Entropy to judge the complexity of each component, and using the Hurst parameter to determine the generation of abnormal traffic. Compared with traditional detection methods, the model can effectively overcome the problems of poor adaptive ability and low efficiency and has high accuracy, which can be used for attack detection and prevention of network nodes. K E Y W O R D S computer network security, data flow analysis, software reliability, transport protocols 1 | INTRODUCTION Blockchain technology is an integrated and innovative application of various IT technologies. It is a technical solution for storing, verifying, transmitting, and exchanging network data without relying on a third party and its distributed nodes. It has two core characteristics: data is difficult to tamper with and decentralisation. Based on these two characteristics, the information recorded by the Blockchain is more authentic and reliable, which can help solve the problem of people's mutual distrust [1, 2]. It solves the problem of data trust and security through distributed ledgers, consensus mechanisms, smart contracts, authorisation, and encryption [3]. In recent years, Blockchain technology is continuously empowering various fields. Figure 1 shows a 5G wireless network and Blockchainbased network architecture. The architecture collects real-time data through the Internet of Things and uploads the data and events to the Blockchain platform, enabling secure scheduling of terminal devices connected to the 5G network [4]. Integrating 5G and Blockchain technology will open the era of inter-chain integration, which can provide an efficient, safe, and fast service experience. With the continuous development This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

show abstract

Section: Eemd Algorithmmentioning

confidence: 99%

Retracted: Anomaly detection with ensemble empirical mode decomposition and approximate entropy for quick user datagram protocol internet connection‐based distributed Blockchain systems

Cao

et al. 2023

IET Software

View full text Add to dashboard Cite

show abstract

“…is will bring serious overfitting problems to the model, which makes the model unable to correctly distinguish normal behaviors and malicious behaviors. erefore, we propose an ensemble learning strategy based on the Bagging algorithm [29] to avoid this problem and alleviate the overfitting problem caused by data imbalance. Specifically, instead of using a single detector, we use the ensemble of multiple weaker detectors to detect malicious sessions.…”

Section: Ensemble Detectormentioning

confidence: 99%

Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning

Zhang

Wang

Zhan

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

Recent studies have highlighted that insider threats are more destructive than external network threats. Despite many research studies on this, the spatial heterogeneity and sample imbalance of input features still limit the effectiveness of existing machine learning-based detection methods. To solve this problem, we proposed a supervised insider threat detection method based on ensemble learning and self-supervised learning. Moreover, we propose an entity representation method based on TF-IDF to improve the detection effect. Experimental results show that the proposed method can effectively detect malicious sessions in CERT4.2 and CERT6.2 datasets, where the AUCs are 99.2% and 95.3% in the best case.

show abstract

“…Recently, deep neural network models, such as Convolutional Neural Network [2,3] (CNN) and Recurrent Neural Network [4,5] (RNN), are widely used for traffic anomaly detection since they are able to capture the spatial and temporal information in raw flow data. Current research has integrated the above methods.…”

Section: Introductionmentioning

confidence: 99%

An effective network traffic anomaly detection method based on deep learning for low-orbit satellite

Wang

2023

International Conference on Intelligent Systems, Communications, and Computer Networks (ISCCN 2023)

View full text Add to dashboard Cite

With the development of satellite networking technology, low-orbit satellites are gradually facing security threats caused by abnormal traffic. Since some types of attack traffic do not pass through ground stations, we are trying to migrate ground anomaly detection capabilities to satellites. In prior arts, many deep learning methods have been applied to network traffic anomaly detection. However, most of them have deep layers of neural networks and are unsuitable for satellites with limited energy and computing capacity. In this paper, we present SAT-NTAD, an effective low-orbit satellite network traffic anomaly detection method that combines shallow Convolutional Auto-encoder (CAE) and Bidirectional Simple Recurrent Unit (Bi-SRU) to extract the spatial and contextual features of traffic flows, and detects anomalies by utilizing dynamic threshold. Extensive experimental evaluations show that our method can stably maintain the high performance for abnormality detection, which outperforms state-of-the-art approaches, and effectively reduces the computational cost, which is more suitable for the low computing capacity environment of satellites.

show abstract

An Improved Parallel Network Traffic Anomaly Detection Method Based on Bagging and GRU

Cited by 11 publications

References 22 publications

Retracted: Anomaly detection with ensemble empirical mode decomposition and approximate entropy for quick user datagram protocol internet connection‐based distributed Blockchain systems

Retracted: Anomaly detection with ensemble empirical mode decomposition and approximate entropy for quick user datagram protocol internet connection‐based distributed Blockchain systems

Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning

An effective network traffic anomaly detection method based on deep learning for low-orbit satellite

Contact Info

Product

Resources

About