Journal of Computer Applications ›› 2024, Vol. 44 ›› Issue (4): 1027-1034.DOI: 10.11772/j.issn.1001-9081.2023050649

• The 9th National Conference on Intelligent Information Processing(NCIIP 2023) • Previous Articles     Next Articles

Network abnormal traffic detection based on port attention and convolutional block attention module

Bin XIAO1, Yun GAN1, Min WANG2, Xingpeng ZHANG1(), Zhaoxing WANG3   

  1. 1.School of Computer Science and Software Engineering,Southwest Petroleum University,Chengdu Sichuan 610500,China
    2.School of Electrical Engineering and Information,Southwest Petroleum University,Chengdu Sichuan 610500,China
    3.PetroChina Chuanqing Drilling Engineering Company Limited,Chengdu Sichuan 610066,China
  • Received:2023-05-24 Revised:2023-07-08 Accepted:2023-07-14 Online:2024-04-22 Published:2024-04-10
  • Contact: Xingpeng ZHANG
  • About author:XIAO Bin, born in 1978, M. S., professor. His research interests include software engineering, enterprise informatization.
    GAN Yun, born in 1998, M. S. candidate. His research interests include network abnormal traffic detection.
    WANG Min, born in 1980, M. S., professor. Her research interests include active learning, signal and information processing.
    ZHANG Xingpeng, born in 1989, Ph. D., lecturer. His research interests include computer vision, object detection and segmentation.
    WANG Zhaoxing, born in 1982, senior engineer. His research interests include industrial informatization, big data application.
  • Supported by:
    Sichuan Science and Technology Program(2022JDRC0009);Natural Science “Sailing Plan” Project of Southwest Petroleum University(2022QHZ023)


肖斌1, 甘昀1, 汪敏2, 张兴鹏1(), 王照星3   

  1. 1.西南石油大学 计算机与软件学院,成都 610500
    2.西南石油大学 电气信息学院,成都 610500
    3.中国石油川庆钻探工程有限公司,成都 610066
  • 通讯作者: 张兴鹏
  • 作者简介:肖斌(1978—),男,重庆人,教授,硕士,CCF会员,主要研究方向:软件工程、企业信息化
  • 基金资助:


Network abnormal traffic detection is an important part of network security protection. At present, abnormal traffic detection methods based on deep learning treat the port number attribute the same as other traffic attributes, ignoring the importance of the port number. Considering the idea of attention, a novel abnormal traffic detection module based on Convolutional Neural Network (CNN) combining Port Attention Module (PAM) and Convolutional Block Attention Module (CBAM) was proposed to improve the performance of abnormal traffic detection. Firstly, the original network traffic was taken as the input of PAM, the port number attribute was separated and sent to the full connected layer, and the learned port attention weight value was obtained, and the traffic data after port attention was output by dot-multiplying with other traffic attributes. Then, the traffic data was converted into a grayscale map, and CNN and CBAM were used to extract the the channel and space information of the feature map more fully. Finally, the focus loss function was used to solve the problem of data imbalance. The proposed PAM has the advantages of few parameters, plug and play, and universal applicability. The accuracy of the proposed model is 99.18% for the binary-class classification task of abnormal traffic detection and 99.07% for the multi-class classification task on the CICIDS2017 dataset, and it also has a high recognition rate for classes with only a few training samples.

Key words: abnormal traffic detection, attention mechanism, data imbalance, lightweight network, Convolutional Block Attention Module (CBAM)



关键词: 异常流量检测, 注意力机制, 数据不平衡, 轻量级网络, 通道空间注意力模块

CLC Number: