Abstract:

Network traffic anomaly detection is a network security defense method that involves analyzing and determining network traffic to identify potential attacks. A new approach was proposed to address the issue of low detection accuracy and high false positive rate caused by imbalanced high-dimensional network traffic data and different attack categories. One Dimensional Convolutional Neural Network（1D-CNN） and Bidirectional Gated Recurrent Unit （BiGRU） were combined to construct a model for traffic anomaly detection. For class-imbalanced data， balanced processing was performed by using an improved Synthetic Minority Oversampling TEchnique （SMOTE）， namely Borderline-SMOTE， and an undersampling clustering technique based on Gaussian Mixture Model （GMM）. Subsequently， a one-dimensional CNN was utilized to extract local features in the data， and BiGRU was used to better extract the time series features in the data. Finally， the proposed model was evaluated on the UNSW-NB15 dataset， achieving an accuracy of 98.12% and a false positive rate of 1.28%. The experimental results demonstrate that the proposed model outperforms other classic machine learning and deep learning models， it improves the recognition rate for minority attacks and achieves higher detection accuracy.

Key words: traffic anomaly detection, imbalance processing, feature selection, Convolutional Neural Network (CNN), Bidirectional Gated Recurrent Unit (BiGRU)

摘要：

网络流量异常检测是利用各种检测技术分析判断网络流量，发现网络中潜在的攻击，是一种有效的网络安全防护方法。针对高维海量数据和不同攻击类别的网络流量数据不均衡而导致检测准确率低、误报率高的问题，提出一种融合一维卷积神经网络（1D-CNN）和双向门控循环单元（BiGRU）的类不平衡流量异常检测模型。首先，针对类不平衡数据，通过使用改进的合成少数类过采样技术（SMOTE）即Borderline-SMOTE和基于高斯混合模型（GMM）的欠采样聚类技术进行平衡处理；然后，使用1D-CNN提取数据的局部特征，并利用BiGRU更好地提取数据中的时序特征；最后，在UNSW-NB15数据集对所提模型进行验证，所提模型的准确率为98.12%，误报率为1.28%。结果表明，所提模型提高了对少数攻击的识别率，检测精度高于其他经典机器学习和深度学习模型。

关键词: 流量异常检测, 不平衡处理, 特征选择, 卷积神经网络, 双向门控循环单元