Network traffic abnormal behavior identification method based on autocoder

Abstract

The invention provides a network traffic abnormal behavior identification method based on an autocoder. The invention belongs to the crossing technical field of machine learning and information security combination. The category distribution of normal traffic data and abnormal traffic data in traffic data is balanced by using a comprehensive minority oversampling method, and an autocoder is combined, so that nonlinear structure information can be effectively extracted from mass data, and abnormal behaviors in network traffic can be identified.

Description

technical field [0001] The invention proposes an effective method for identifying abnormal behaviors of network traffic. The method combines the comprehensive minority oversampling method and the autoencoder classification algorithm, and belongs to the cross-technical field of combining machine learning and information security. Background technique [0002] With the rapid development of the information age, the Internet has become an indispensable part of people's lives. However, the frequency and scale of attacks in the network are also increasing. These attacks will not only cause huge economic losses, but also pose a serious threat to social stability and national security. Maintaining the security of cyberspace has become an urgent problem to be solved. The problem. In order to better maintain cyberspace security, ensure the availability of various network resources, and prevent various attacks, intrusion detection technology as an active defense method has become a h...

AI Technical Summary

Problems solved by technology

However, these deep learning methods for intrusion detection still have some problems

[0005] For example, due to the problem of class imbalance, many studies have not considered the overall distribution of traffic data, the decision function is biased towards the majority of samples, and low-frequency attack samples are regarded as noise and ignored, making it difficult for the model to capture effective features and detect low-frequency attacks. attack

On the other hand, some studies did not process high-dimensional data when converting symbolic data to numerical data, resulting in low training efficiency, consuming storage space, and poor detection performance

Images