关键词: 流量异常检测, 不平衡处理, 特征选择, 卷积神经网络, 双向门控循环单元

Abstract:

Network traffic anomaly detection is a network security defense method that involves analyzing and determining network traffic to identify potential attacks. A new approach was proposed to address the issue of low detection accuracy and high false positive rate caused by imbalanced high-dimensional network traffic data and different attack categories. One Dimensional Convolutional Neural Network（1D-CNN） and Bidirectional Gated Recurrent Unit （BiGRU） were combined to construct a model for traffic anomaly detection. For class-imbalanced data， balanced processing was performed by using an improved Synthetic Minority Oversampling TEchnique （SMOTE）， namely Borderline-SMOTE， and an undersampling clustering technique based on Gaussian Mixture Model （GMM）. Subsequently， a one-dimensional CNN was utilized to extract local features in the data， and BiGRU was used to better extract the time series features in the data. Finally， the proposed model was evaluated on the UNSW-NB15 dataset， achieving an accuracy of 98.12% and a false positive rate of 1.28%. The experimental results demonstrate that the proposed model outperforms other classic machine learning and deep learning models， it improves the recognition rate for minority attacks and achieves higher detection accuracy.

Key words: traffic anomaly detection, imbalance processing, feature selection, Convolutional Neural Network (CNN), Bidirectional Gated Recurrent Unit (BiGRU)