Training method and detection method of network traffic anomaly detection model

Abstract

The invention discloses a training method and a detection method of a network traffic anomaly detection model. The network traffic anomaly detection model comprises a feature extraction network and aclassification network, and the training method comprises the following steps: determining the number of hidden layers and the number of neurons in each hidden layer according to a training sample; constructing an initial feature extraction network according to the number of the hidden layers and the number of neurons in each hidden layer; training the initial feature extraction network by using atraining sample to obtain a trained feature extraction network; extracting abstract feature data of a training sample by using the trained feature extraction network, and training a classification network by using the abstract feature data so as to complete training of a network traffic detection model. The network structure can adapt to network flow data, the situation that the structure of a detection model is too complex and too simple is avoided, and therefore, generalization errors are reduced, the detection time can be obviously shortened, and the detection accuracy can be obviously improved.

Description

technical field [0001] The invention belongs to the field of information technology, and in particular relates to a training method and a detection method of a network traffic anomaly detection model, a computer-readable storage medium, and a computer device. Background technique [0002] With the rapid development of the Internet and the continuous expansion of the network scale, the Internet has become an indispensable part of human production and life. But at the same time, people inevitably suffer from network anomalies in the process of enjoying the convenience of the network. A variety of network anomalies that are prevalent at present can be manifested through abnormal network traffic. Abnormal network traffic can more comprehensively reflect the real-time status of the network, such as network scanning, DDoS attacks, network worms, etc., to discover the network in time Abnormal traffic changes are of great significance to the abnormal location of the network data ce...

AI Technical Summary

Problems solved by technology

[0005] When traditional machine learning is applied to the anomaly detection of the model, there is a problem of prior experience, especially for network traffic data with a large amount of data and strong real-time performance. Inappropriate parameter selection or poor quality of selected data will affect the The detection effect of the model has a relatively large impact

For example, if the selected neural network model has a large number of layers, the convergence may be slow during the training process. If the selected neural network model has a small number of layers, the network may not be adjusted accurately during the training process. parameters, it is not easy to obtain a detection model with high accuracy

Images