Network situation prediction method based on deep feature and Seq2Seq model
LIN Zhixing1,2, WANG Like3
1. Network Center, Sanming University, Sanming Fujian 365004, China; 2. College of Mathematics and Informatics, Fujian Normal University, Fuzhou Fujian 350007, China; 3. Chengdu Institute of Computer Application, Chinese Academy of Sciences, Chengdu Sichuan 610041, China
Abstract：In view of the problem that most existing network situation prediction methods are unable to mine the deep information in the data and need to manually extract and construct features, a deep feature network situation prediction method named DFS-Seq2Seq (Deep Feature Synthesis-Sequence to Sequence) was proposed. First, the data produced by network streams, logs and system events were cleaned, and the deep feature synthesis algorithm was used to automatically synthesize the deep relation features. Then the synthesized features were extracted by the AutoEncoder (AE). Finally, the data was estimated by using the Seq2Seq (Sequence to Sequence) model constructed by Long Short-Term Memory (LSTM). Through a well-designed experiment, the proposed method was verified on the public dataset Kent2016. Experimental results show that when the depth is 2, compared with four classification models including Support Vector Machine (SVM), Bayes, Random Forest (RF) and LSTM, the proposed method has the recall rate increased by 7.4%, 11.5%, 6.5% and 3.0%, respectively. It is verified that DFS-Seq2Seq can effectively identify dangerous events in network authentication and effectively predict network situation in practice.
林志兴, 王立可. 基于深度特征和Seq2Seq模型的网络态势预测方法[J]. 计算机应用, 2020, 40(8): 2241-2247.
LIN Zhixing, WANG Like. Network situation prediction method based on deep feature and Seq2Seq model. Journal of Computer Applications, 2020, 40(8): 2241-2247.
[1] 陈雷,司志刚,鹤荣育,等. 基于改进自适应灰色模型的网络安全态势预测[J]. 计算机科学, 2014, 41(11A):259-262. (CHEN L, SI Z G, HE R Y, et al. Network security situation prediction based on improved adaptive grey model[J]. Computer Science, 2014, 41(11A):259-262.) [2] 张勇东,陈思洋,彭雨荷,等. 基于深度学习的网络入侵检测研究综述[J]. 广州大学学报(自然科学版), 2019, 18(3):17-26. (ZHANG Y D, CHEN S Y, PENG Y H, et al. A survey of deep learning based network intrusion detection[J]. Journal of Guangzhou University (Natural Science Edition), 2019, 18(3):17-26.) [3] FAROOQI A H, KHAN F A. Intrusion detection systems for wireless sensor networks:a survey[C]//Proceedings of the 2009 International Conference on Future Generation Communication and Networking, CCIS 56. Berlin:Springer, 2009:234-241. [4] KUMAR G R, LANJEWAR U A. Intrusion detection and prevention system:classification and quick review[J]. International Journal of Computer Science and Information Security, 2012, 10(5):78-83. [5] FUCHSBERGER A. Intrusion detection systems and intrusion prevention systems[J]. Information Security Technical Report, 2005, 10(3):134-139. [6] ROUGHAN M, SEN S, SPATSCHECK O, et al. Class-of-service mapping for QoS:a statistical signature-based approach to IP traffic classification[C]//Proceedings of the 4th ACM SIGCOMM conference on Internet measurement. New York:ACM, 2004:135-148. [7] YIN C, ZHU Y, FEI J, et al. A deep learning approach for intrusion detection using recurrent neural networks[J]. IEEE Access, 2017, 5:21954-21961. [8] ZHANG L, WHITE G B. An approach to detect executable content for anomaly based network intrusion detection[C]//Proceedings of the 2007 IEEE Conference on International Parallel and Distributed Processing Symposium. Piscataway:IEEE, 2007:1-8. [9] YUAN X, LI C, LI X. DeepDefense:identifying DDoS attack via deep learning[C]//Proceedings of the 2017 Conference on Smart Computing. Piscataway:IEEE, 2017:1-8. [10] SUTSKEVER I, VINYALS O, LE Q V. Sequence to sequence learning with neural networks[C]//Proceedings of the 27th International Conference on Neural Information Processing Systems. Cambridge:MIT Press, 2014:3104-3112. [11] NALLAPATI R, ZHOU B, DOS SANTOS C, et al. Abstractive text summarization using sequence-to-sequence RNNs and beyond[EB/OL].[2019-09-26]. https://arxiv.org/pdf/1602.06023.pdf. [12] ZHOU H, HUANG M, ZHANG T, et al. Emotional chatting machine:emotional conversation generation with internal and external memory[EB/OL].[2019-04-04]. https://arxiv.org/pdf/1704.01074.pdf. [13] WANG Z, HE W, WU H, et al. Chinese poetry generation with planning based neural network[EB/OL].[2019-10-31].https://arxiv.org/pdf/1610.09889.pdf. [14] 陶涛,周喜,马博,等. 基于双向LSTM的Seq2Seq模型在加油站时序数据异常检测中的应用[J]. 计算机应用, 2019, 39(3):924-929. (TAO T, ZHOU X, MA B, et al. Abnormal time series data detection of gas station by Seq2Seq model based on bidirectional long short-term memory[J]. Journal of Computer Applications, 2019, 39(3):924-929.) [15] LAMPLE G, CHARTON F. Deep learning for symbolic mathematics[EB/OL].[2019-12-02].https://arxiv.org/pdf/1912.01412.pdf [16] KANTER J M, VEERAMACHANENI K. Deep feature synthesis:Towards automating data science endeavors[C]//Proceedings of the 2015 IEEE International Conference on Data Science and Advanced Analytics. Piscataway:IEEE, 2015:1-10. [17] 袁非牛,章琳,史劲亭. 自编码神经网络理论及应用综述[J]. 计算机学报, 2019, 42(1):203-230. (YUAN F N, ZHANG L,SHI J T. Theories and applications of auto-encoder neural networks:a literature survey[J]. Chinese Journal of Computers, 2019, 42(1):203-230.) [18] RAO K, PENG F, SAK H, et al. Grapheme-to-phoneme conversion using long short-term memory recurrent neural networks[C]//Proceedings of the 2015 IEEE International Conference on Acoustics, Speech and Signal Processing. Piscataway:IEEE, 2015:4225-4229. [19] JI H, LONG J, FU Y, et al. Flow pattern identification based on EMD and LS-SVM for gas-liquid two-phase flow in a minichannel[J]. IEEE Transactions on Instrumentation and Measurement, 2011, 60(5):1917-1924. [20] 丁君美,刘贵全,李慧. 改进随机森林算法在电信业客户流失预测中的应用[J]. 模式识别与人工智能, 2015, 28(11):1041-1049. (DING J M, LIU G Q, LI H. The application of improved random forest in the telecom customer churn prediction[J]. Pattern Recognition and Artificial Intelligence, 2015, 28(11):1041-1049.) [21] HOERL A E, KENNARD R W. Ridge regression:biased estimation for nonorthogonal problems[J]. Technometrics, 1970, 12(1):55-67.
2020, Vol. 40 
