关键词: 流量异常检测, 不平衡处理, 特征选择, 卷积神经网络, 双向门控循环单元

Abstract: Abstract: Network traffic anomaly detection is a network security defense method that involves analyzing and determining network traffic to identify potential attacks. This thesis proposes a novel approach to address the issue of low detection accuracy and high false positive rate caused by imbalanced high-dimensional network traffic data and different attack categories. The proposed approach combines Convolutional Neural Network (CNN) and Bidirectional Gated Recurrent Unit (BiGRU) to form a model for anomaly traffic detection. For class-imbalanced data, balanced processing is performed by using an improved synthetic minority oversampling technique ( SMOTE ), namely borderline-SMOTE, and an undersampling clustering technique based on Gaussian mixture model ( GMM ). Subsequently, a one-dimensional CNN network is utilized to extract local features from the time series, and BiGRU can better extract the time series features in the data. Finally, the model is evaluated on the UNSW-NB15 dataset, achieving an accuracy of 98.12% and a false positive rate of 1.28%. The experimental results demonstrate that the model outperforms other classic machine learning and deep learning models by improving the recognition rate for minority attacks and achieving higher detection accuracy.

Key words: Traffic anomaly detection, Imbalance processing, Feature selection, Convolutional neural network, Bidirectional gated recurrent unit