Abnormal traffic detection method based on autoencoder network

Abstract

The invention discloses an abnormal traffic detection method based on an autoencoder network and belongs to the crossing field of a computer network and machine learning. The method comprises the steps of capturing data through utilization of a traffic data obtaining module; preprocessing the data through utilization of a data preprocessing module; outputting hash codes of the traffic data throughutilization of an improved multi-autoencoder network; and carrying out abnormal detection multi-classification on the obtained hash codes through adoption of a detection module based on a data distribution proportion. According to the method, advantages of a neural network and the hash codes are combined; through utilization of a hash encoding technology, consumed memory space and computing resources are reduced; a KitNET autoencoder network which only can be applied to a binary-classification intrusion detection scene is improved into a multi-classification intrusion detection method; and atraffic hash code classification method based on the data distribution proportion is designed. According to the method, an operation rate and expansibility of an abnormal detection technology can be improved. The method is relatively applicable to solution of the abnormal detection problem that new attack types emerge in endlessly at present.

Description

technical field [0001] The invention belongs to the intersecting field of computer network and machine learning, and relates to an abnormal flow detection method based on an automatic encoder network. Background technique [0002] Nowadays, with the increasing popularity of application devices connected to the Internet, more and more businesses need to rely on the network to complete. Due to the continuous iterative development of network attack methods and attack scales, network intrusion has become one of the biggest threats to cyberspace. The main goal of intrusion detection is to identify abnormal behaviors and attempts in the network and computer systems. There are various types of attacks. At the same time, with the development of the Internet, various new types of attacks emerge in an endless stream. The traditional feature-based attack detection is time-sensitive. And generalization defects make new attacks undetectable, so it is difficult to adapt to the needs of th...

AI Technical Summary

Problems solved by technology

However, when the neural network-based anomaly detection method is actually implemented in a real application scenario, there are still some bottlenecks and problems

[0004] First of all, the current neural network-based anomaly detection methods use complex network structures or even deep neural networks to learn the characteristics of existing samples, which usually requires a lot of resources and computing power to complete, and most of the algorithms are Training in a supervised manner, the process of labeling data categories is very time-consuming and energy-consuming, and whenever a new type of traffic appears, the entire neural network needs to be retrained, otherwise the correct classification cannot be obtained, and manual Only by constantly updating the model can we get a high-accuracy intrusion detection system

KitNET proposed by Mirsky is an efficient unsupervised anomaly detection algorithm based on neural networks, but it can only be used for binary classification anomaly detection, and cannot predict different attack types of intrusion traffic, which has limitations in application scenarios

[0005] Secondly, for the real Internet environment, traffic data usually has the following characteristics: there are many types of abnormal traffic, but the amount is far less than that of normal traffic data, that is to say, the distribution of normal traffic data and intrusion data is usually unbalanced in quantity, Most of the current algorithms do not take into account the unbalanced state of data distribution, but simply classify the data through the trained neural network, resulting in suboptimal detection results

Images