Journal of Computer Applications ›› 2021, Vol. 41 ›› Issue (2): 433-440.DOI: 10.11772/j.issn.1001-9081.2020050734

Special Issue: 网络空间安全

• Cyber security • Previous Articles     Next Articles

Abnormal flow detection based on improved one-dimensional convolutional neural network

HANG Mengxin, CHEN Wei, ZHANG Renjie   

  1. School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing Jiangsu 210023, China
  • Received:2020-06-01 Revised:2020-08-06 Online:2021-02-10 Published:2020-09-15
  • Supported by:
    This work is partially supported by the National Key Research and Development Program of China (2019YFB2101704).

基于改进的一维卷积神经网络的异常流量检测

杭梦鑫, 陈伟, 张仁杰   

  1. 南京邮电大学 计算机学院, 南京 210023
  • 通讯作者: 陈伟
  • 作者简介:杭梦鑫(1996-),女,江苏丹阳人,硕士研究生,CCF会员,主要研究方向:网络安全、机器学习;陈伟(1979-),男,江苏淮安人,教授,博士,CCF会员,主要研究方向:网络安全;张仁杰(1995-),男,河北廊坊人,硕士研究生,CCF会员,主要研究方向:网络安全、机器学习。
  • 基金资助:
    国家重点研发计划项目(2019YFB2101704)。

Abstract: In order to solve the problems that traditional machine learning based abnormal flow detection methods rely heavily on features, and the detection methods based on deep learning are inefficient and easy to overfit, an abnormal flow detection method based on Improved one-Dimentional Convolutional Neural Network (ICNN-1D) was proposed, namely AFM-ICNN-1D. Different from "convolution-pooling-full connection" structure of the traditional CNN, the ICNN-1D is mainly composed of 2 convolutional layers, 2 global pooling layers, 1 dropout layer and 1 fully connected output layer. The preprocessed data were put into ICNN-1D, and the result after two convolutional layers was used as the input of the global average pooling layer and the global maximum pooling layer, then the obtained output data were merged and sent to the fully connected layer to classify. The model was optimized according to the classification result and the real dataset, then it was used to the abnormal flow detection. The experimental results on the CIC-IDS-2017 dataset showed that the accuracy and recall rate of AFM-ICNN-1D reached 98%, which is better than that of the comparative k-Nearest Neighbor (kNN) and Random Forest (RF) methods. Moreover, compared with traditional CNN, the model parameters were reduced by about 97%, and the training time was shortened by about 40%. Experimental results show that AFM-ICNN-1D has high detection performance, which can reduce training time and avoid over fitting with better retaining the local characteristics of traffic data.

Key words: network security, abnormal flow detection, deep learning, Convolutional Neural Network (CNN), global pooling

摘要: 针对传统机器学习方法对特征依赖大、基于深度学习的检测方法效率低以及易过拟合的问题,提出一种基于改进的一维卷积神经网络(ICNN-1D)的异常流量检测方法(AFM-ICNN-1D)。与传统卷积神经网络(CNN)采用的“卷积-池化-全连接”结构不同,ICNN-1D主要由2个卷积层、2个全局池化层、1个dropout层和1个全连接输出层构成;其次,将预处理后的数据输入到ICNN-1D中,并将经过两次卷积之后的结果作为全局平均池化层与全局最大池化层的输入,之后将所得到的输出数据进行合并再送入全连接层进行分类;最后根据分类结果与真实数据对网络模型进行调优,再将训练好的模型用于异常流量检测。CIC-IDS-2017数据集上的实验结果显示,AFM-ICNN-1D的精准率和召回率均达到了98%,优于对比的k近邻(kNN)和随机森林(RF)方法;而且与传统的CNN相比,该方法的参数减少了约97%,训练时间缩短了约40%。实验结果表明,AFM-ICNN-1D具有较高的检测性能,能减少训练时间、避免过拟合现象的发生,而且能更好地保留流量数据的局部特征。

关键词: 网络安全, 异常流量检测, 深度学习, 卷积神经网络, 全局池化

CLC Number: