《计算机应用》唯一官方网站

• •    下一篇

基于多模型并行融合网络的恶意流量检测方法

李向军,王俊洪,王诗璐,陈金霞,孙纪涛,王建辉   

  1. 南昌大学软件学院
  • 收稿日期:2023-05-29 修回日期:2023-09-05 发布日期:2023-09-15 出版日期:2023-09-15
  • 通讯作者: 王俊洪

A malicious traffic detection method based on multi model parallel fusion network

  • Received:2023-05-29 Revised:2023-09-05 Online:2023-09-15 Published:2023-09-15

摘要: 摘 要: 针对单一串行深度学习检测模型提取流量特征时无法完整反映原始流量信息且降低恶意流量识别精度的问题, 设计了多模型并行融合网络,提出了一种基于多模型并行融合网络的恶意流量检测方法。该方法采用并行方式,融合一维卷 积神经网络(1D-CNN)与双向长短期记忆网络(Bi-LSTM)进行特征提取和流量识别,各条支路均直接面向原始流量,同时 提取流量的空间特征与时序特征,采用共同的全连接层进行特征融合,可更加精准地反映原始流量信息并有效提高恶意流量 的识别准确率。开源 UNSW-NB 15 数据集上的实验结果表明,所提出方法在恶意流量检测的特征提取能力、鲁棒性以及在线 学习能力以及检测速率等方面均表现出优越的性能。

Abstract: Abstract: In this paper, we propose a malicious traffic detection method based on a multi-model parallel fusion network to address the issue of incomplete reflection of original traffic information and reduced accuracy in identifying malicious traffic by a single sequential deep learning detection model. This method adopts a parallel approach, combining one-dimensional convolutional neural network (1D-CNN) and bidirectional long short-term memory network (Bi-LSTM) for feature extraction and traffic recognition. Each branch directly focuses on the original traffic, extracting both spatial and temporal features. A common fully connected layer is used for feature fusion, which can more accurately reflect the original traffic information and effectively improve the accuracy of malicious traffic identification. Experimental results on the open-source UNSW-NB 15 dataset demonstrate the superior performance of the proposed method in terms of feature extraction capability, robustness, online learning ability and and detection rate for malicious traffic detection.

中图分类号: