A method and apparatus for detecting abnormal network traffic

Abstract

This invention belongs to the field of network security detection and proposes a method and device for detecting abnormal network traffic. The method automatically learns the number of hidden layer neurons and the learning rate of a GRU network using an improved Grey Wolf Optimization (IGWO) algorithm. Addressing the periodic and temporal characteristics of network traffic, it employs an anomaly detection model combining gated recurrent units with the proposed adaptive Grey Wolf Optimization algorithm to classify abnormal traffic. The improved Grey Wolf Optimization algorithm optimizes the parameters and structure of the neural network, improving both detection speed and accuracy. The linear decay of parameter 'a' is modified to a non-linear decay to increase the proportion of global search iterations. A higher number of global search iterations enhances the algorithm's global search capability and reduces the likelihood of getting trapped in local optima.

Description

Technical Field

[0001] This invention relates to the field of network security detection, and in particular to a method and apparatus for detecting abnormal network traffic. Background Technology

[0002] With the development of computer technology, new technologies and tools for launching various attacks against networks are constantly emerging. Early network security protection methods were mostly based on traditional proactive security defense strategies. However, early solutions, under conditions of limited resources and high network throughput, could not meet the requirements for real-time detection and management of intrusion activities. Therefore, in recent years, research on abnormal network traffic detection has gradually become a hot topic in the field of network security. How to ensure system security, prevent external intrusion, or promptly detect and stop attacks has become a focal point of concern for researchers and engineers in the network security industry worldwide.

[0003] The paper "Barbosa RRR, Sadre R, Pras A. Towards periodicity based anomaly detection in SCADA networks [C] / / Proceedings of 2012 IEEE 17th International Conference on Emerging Technologies & Factory Automation (ETFA 2012). IEEE, 2012: 1-4" proposes an anomaly measurement method based on the periodic changes in network traffic. This method can not only detect intrusion behavior in the network, but also detect abnormal traffic based on changes in traffic period after identifying intrusion behavior.

[0004] The paper "Jaiswal S, Saxena K, Mishra A, et al. A KNN-ACO approach for intrusion detection using KDDCUP'99 dataset [C] / / 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom). IEEE, 2016: 628-633." improves the KNN model using the ant colony optimization algorithm, and experiments on the KDD99 dataset demonstrate that it can effectively reduce false positives.

[0005] The paper "Barbosa RRR, Sadre R, Pras A. Towards periodicity based anomaly detection in SCADA networks[C] / / Proceedings of 2012 IEEE 17th International Conference on Emerging Technologies & Factory Automation (ETFA 2012). IEEE, 2012: 1-4" proposes an anomaly measurement method based on the periodic changes in network traffic. However, due to the great uncertainty of the periodic changes in network traffic, the visualized anomaly detection model constructed by using a sliding window and Fast Fourier Transform (FFT) has high detection efficiency, but it has a significant lack of accuracy.

[0006] The paper "Jaiswal S, Saxena K, Mishra A, et al. A KNN-ACO approach for intrusion detection using KDDCUP'99 dataset [C] / / 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom). IEEE, 2016: 628-633." improves the KNN model using the ant colony optimization algorithm, but the computational cost increases significantly when the data scale is large, resulting in poor performance.

[0007] In recent years, although many methods for detecting abnormal network traffic have been developed, these methods still face two main challenges: 1) they cannot fully consider the characteristics of network traffic, such as periodicity and temporality; 2) the use and improvement of optimization algorithms. Summary of the Invention

[0008] This invention proposes a method and apparatus for detecting abnormal network traffic. Addressing the problem of poor population diversity and susceptibility to local optima in the later stages of the Grey Wolf Optimization Algorithm (IGWO), an adaptive adjustment strategy for the IGWO algorithm is proposed. Based on the characteristics of network traffic, a GRU model is selected, and the improved optimization algorithm is applied to the model to optimize its structure and parameters, thereby obtaining the optimal network model and improving the algorithm's execution speed and accuracy.

[0009] The technical solution of the present invention is as follows: A method for detecting abnormal network traffic, comprising:

[0010] Step 1: Initialize the gray wolf population information, convergence factor a, first coefficient vector A, and second coefficient vector C in the gray wolf algorithm; where the gray wolf location information includes the number of hidden layer neurons u and the network learning rate l;

[0011] Step 2: Input the number of hidden neurons u and the learning rate l from the gray wolf location information into the gated recurrent unit (GRU) network, and use the training set to complete the model training;

[0012] Step 3: The accuracy of the test set through the GRU network is used as the fitness of individual gray wolves; and the average fitness of the gray wolf population is calculated.

[0013] Step 4: If the fitness of the current gray wolf individual is greater than the average fitness, update the gray wolf position information and the values ​​of convergence factor a, first coefficient vector A, and second coefficient vector C using the Gray Wolf Optimization Algorithm (GWO); otherwise, update the gray wolf position information and the values ​​of parameters a, A, and C using the improved Gray Wolf Optimization Algorithm (IGWO); the values ​​of u and l change accordingly when updating the position information.

[0014] Step 5: When the maximum number of iterations is reached, output the location information of the IGWO-GRU model and α. The current model is taken as the optimal model, and the optimal values ​​of u and l are obtained from the location information of α. Otherwise, jump to step 2 until the iteration is completed, and then output the location information of the model and α. The optimal model or the output model is used as the model for network abnormal traffic detection.

[0015] The construction process of the GRU network is as follows;

[0016] 2.1 Capture industrial control network traffic data and divide the data into training set and test set; wherein the training set is used to fit the model classifier parameters, and the test set is used to test the performance of the model classifier.

[0017] 2.2 The training set and test set are limited to a certain range by a normalization function to obtain the normalized training set and test set;

[0018] 2.3 Determine the structure of the GRU network, which includes an input layer, hidden layers, and an output layer; input the normalized training set into the GRU network for parameter training; wherein the GRU network parameters include the learning rate, the number of hidden layers, and the number of hidden layer neurons; the output layer uses softmax as the activation function, and the output result is a traffic prediction classification label for a certain class;

[0019] 2.4 Train the GRU network, using cross-entropy as the loss function for multi-class classification tasks, and change the network weights through backpropagation;

[0020] Where k is the number of abnormal traffic types, y i These are real category tags, p i It is the output of the GRU network, namely the predicted classification traffic label;

[0021] 2.5 The trained GRU network was validated using a normalized test set to evaluate the accuracy of the model classifier.

[0022] The initial value of the number of hidden layers is in the range of 1-2.

[0023] The specific steps of step four are as follows;

[0024] 4.1 Update the values ​​of parameters a, A, and C:

[0025]

[0026]

[0027] A = 2a·r1-a, C = 2·r2

[0028] Among them, f i f represents the fitness of individual gray wolf i; avg is the average fitness; T is the maximum number of iterations; t is the current number of iterations; A and C are coefficient vectors; a is the convergence factor; r1 and r2 are random vectors between [0,1].

[0029] 4.2 Update the position of the gray wolf X(t+1):

[0030]

[0031] Among them, α, β, and δ represent the top three individuals in terms of fitness, and the remaining individuals are ω; X α X β and X δ These represent the current position information of α, β, and δ, respectively; D α D β and D β X1, X2, and X3 represent the distances between other individuals in the gray wolf population and α, β, and δ, respectively; X1, X2, and X3 represent the distances a gray wolf moves toward α, β, and δ, respectively; C1, C2, and C3 are random vectors; A1, A2, and A3 are random vectors; X(t) represents the current position of a gray wolf.

[0032]

[0033] Where f α f β and f δ Let α, β, and δ represent the fitness.

[0034] The initialization formulas for the convergence factor a, the first coefficient vector A, and the second coefficient vector C are as follows.

[0035]

[0036] Where a is the convergence factor, T is the maximum number of iterations, and t is the current number of iterations.

[0037] The normalization process in step 2.2 uses min-max normalization, and the normalization result is mapped to the range [0, 1].

[0038]

[0039] The min-max normalization method is used to process each column of the industrial control network traffic data x, where Max represents the maximum value in a column and Min represents the minimum value in a column.

[0040] The softmax function in step 2.3 maps all the output results of the output layer neurons to the (0, 1) interval, and the sum of all results is 1. The softmax function assigns a probability value to each output classification result, representing the probability of belonging to each category, and selects the one with the highest probability as the final predicted classification label.

[0041]

[0042] Among them, e i represents the output value of the i-th node, and j is the number of output nodes, i.e., the number of categories.

[0043] A network abnormal traffic detection device, comprising:

[0044] The network module is used to store the GRU network module and the IGWO-GRU network model.

[0045] Memory, used to store network traffic data and computer programs;

[0046] A processor is configured to execute a computer program stored in the memory. When the computer program is executed, the processor is configured to: initialize gray wolf population information in the gray wolf algorithm, as well as convergence factor a, first coefficient vector A, and second coefficient vector C; wherein the gray wolf location information includes the number of hidden layer neurons u and the network learning rate l.

[0047] The number of hidden neurons u and the learning rate l in the gray wolf location information are fed into the gated recurrent unit (GRU) network module, and the training set is used to complete the model training.

[0048] The accuracy of the test set through the GRU network module is used as the fitness of individual gray wolves; and the average fitness of the gray wolf population is calculated.

[0049] If the fitness of a gray wolf is greater than the average fitness, the gray wolf position information and the values ​​of convergence factor a, first coefficient vector A, and second coefficient vector C are updated using the Gray Wolf Optimization Algorithm (GWO); otherwise, the gray wolf position information and the values ​​of parameters a, A, and C are updated using the improved Gray Wolf Optimization Algorithm (IGWO); the values ​​of u and l change accordingly when updating the position information.

[0050] When the maximum number of iterations is reached, the position information of the IGWO-GRU model and α is output, and the current model is taken as the optimal model. The optimal values ​​of u and l are obtained from the position information of α. Otherwise, model training continues until the iteration is completed, and then the position information of the model and α is output. The optimal model or the output model is used as the model for network anomaly traffic detection. The construction process of the GRU network module in the network module includes capturing industrial control network traffic data and dividing it into training set and test set.

[0051] The training set is used to fit the parameters of the model classifier; the test set is used to test the performance of the model classifier.

[0052] The training set and test set are limited to a certain range by a normalization function to obtain the normalized training set and test set;

[0053] The structure of the GRU network module includes an input layer, hidden layers, and an output layer. The normalized training set is input into the GRU network module for parameter training. The GRU network parameters include the learning rate, the number of hidden layers, and the number of hidden layer neurons. The output layer uses softmax as the activation function, and the output result is a traffic prediction classification label for a certain class.

[0054] Train the GRU network module, using cross-entropy as the loss function for multi-class classification tasks, and change the network weight values ​​through backpropagation;

[0055] Where k is the number of abnormal traffic types, y i These are real category tags, p i It is the output of the GRU network, namely the predicted classification traffic label;

[0056] The trained GRU network modules were validated using a normalized test set to evaluate the accuracy of the model classifier.

[0057] The specific steps for updating the gray wolf's location information, convergence factor a, first coefficient vector A, and second coefficient vector C are as follows:

[0058] Update the values ​​of parameters a, A, and C:

[0059]

[0060]

[0061] A = 2a·r1-a, C = 2·r2

[0062] Among them, f i f represents the fitness of individual gray wolf i; avg is the average fitness; T is the maximum number of iterations; t is the current number of iterations; A and C are coefficient vectors; a is the convergence factor; r1 and r2 are random vectors between [0,1].

[0063] Update the position of the gray wolf X(t+1):

[0064]

[0065] Among them, α, β, and δ represent the top three individuals in terms of fitness, and the remaining individuals are ω; X α X β and X δ These represent the current position information of α, β, and δ, respectively; D α D β and D δ X1, X2, and X3 represent the distances between other individuals in the gray wolf population and α, β, and δ, respectively; X1, X2, and X3 represent the distances a gray wolf moves towards α, β, and δ, respectively; C1, C2, and C3 are random vectors; A1, A2, and A3 are random vectors; X(t) represents the current position of the gray wolf individual.

[0066]

[0067] Where f α f β and f δ Let α, β, and δ represent the fitness.

[0068] The initialization formulas for the convergence factor a, the first coefficient vector A, and the second coefficient vector C are as follows.

[0069] A = 2a·r1-a, C = 2·r2

[0070] Where a is the convergence factor, T is the maximum number of iterations, and t is the current number of iterations.

[0071] The beneficial effects of this invention: Based on the temporal and periodic characteristics of network traffic, this invention proposes a network anomaly traffic detection algorithm based on IGWO-GRU. The new algorithm proposed in this invention makes two improvements over the original algorithm: First, the original algorithm did not consider the proportions of optimal, good, and suboptimal solutions when updating positions. Therefore, this invention proposes a weighted adaptive position adjustment strategy, which establishes a probability distribution proportional to fitness to solve for the optimal, good, and suboptimal solutions and the average fitness of the population. The position update method is selected based on the relationship between individual fitness and average fitness. Second, the linear decay of the original parameter 'a' is modified to a non-linear decay to increase the proportion of global search iterations. The more global search iterations, the stronger the algorithm's global search capability and the less likely it is to get trapped in local optima.

[0072] This invention addresses the periodic and temporal characteristics of network traffic by employing a gated recurrent unit combined with the proposed adaptive gray wolf optimization algorithm to classify abnormal traffic. The improved gray wolf optimization algorithm optimizes the parameters and structure of the neural network, thereby increasing both detection speed and accuracy. Attached Figure Description

[0073] Figure 1 Here is a flowchart of the network anomaly traffic detection process based on IGWO-GRU;

[0074] Figure 2 A comparison of the convergence performance of IGWO-GRU and GRU;

[0075] Figure 3 A comparison of the accuracy performance of IGWO-GRU and GRU;

[0076] Figure 4 This is a diagram of a network abnormal traffic detection device based on IGWO-GRU. Detailed Implementation

[0077] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0078] First, the performance of the improved Grey Wolf Optimization (IGWO) algorithm was tested and verified: To verify the effectiveness of the proposed improved Grey Wolf Optimization (IGWO) algorithm, six commonly used test functions in optimization problems were used to test IGWO. The test results were then compared with those of the standard Grey Wolf Optimization (GWO) algorithm and the Particle Swarm Optimization (PSO) algorithm. Table 1 shows the information for the six test functions. Among these six test functions, F1, F2, and F3 are unimodal functions, which are suitable for benchmarking algorithm development. The performance of the algorithm on unimodal functions can effectively measure the quality of the optimization algorithm. F4, F5, and F6 are multimodal functions, which can better simulate the situations encountered in real-world generation and can also be used to measure the algorithm's ability to avoid getting trapped in local optima.

[0079] Table 1 Comparison of Information for Six Functions

[0080]

[0081]

[0082] During this experiment, the following settings were made:

[0083] ① The population size for the three optimization algorithms IGWO, GWO, and PSO is kept constant at 30;

[0084] ② The dimensions of the test functions are all set to 30. In the PSO algorithm, the learning factors c1 = c2 = 2 and the inertia weight ω = 0.9.

[0085] ③ The maximum number of iterations for all three swarm intelligence optimization algorithms is set to 3000;

[0086] ④ Then, run each algorithm independently 30 times to obtain the average and standard deviation of the optimal solution.

[0087] The network data used in the experiments of this invention is the Natural Gas Pipeline Control System Dataset released by Mississippi State University in 2014. This dataset is a general standard dataset in the field of network security, and its traffic data is captured by a network data logger. The dataset contains normal traffic and abnormal traffic generated by 28 attack methods. The data label description is shown in Table 2, and the feature description of each data point is shown in Table 3.

[0088] Table 2 Data Label Information

[0089]

[0090]

[0091] Table 3 Data Feature Information

[0092]

[0093]

[0094] Next, complete the setup and configuration of the IGWO-GRU model:

[0095] ① It uses a Windows platform, with an Intel Core i7-7700HQ processor, 32GB of memory, and an NVIDIA GeForce GTX 1050Ti graphics card with 4GB of video memory;

[0096] ② The programming language used is Python, and the GRU model is implemented using TensorFlow 2.2.0;

[0097] ③ 80% of the experimental dataset was used for model training, and 20% was used for testing;

[0098] ④ The number of hidden layers in the IGWO-GRU algorithm is set to 2, the number of hidden layer neurons u ranges from [8,128], the learning rate l ranges from [0.001,0.1], the population size is set to 30, and the maximum number of iterations is 500.

[0099] To verify the effectiveness of the proposed network anomaly traffic detection algorithm based on IGWO-GRU, this invention compares the model algorithm with four commonly used traffic detection algorithms, GRU, BP, DT, and SVM, through a series of experiments.

[0100] Table 4 Comparison of the performance of five traffic detection algorithms

[0101]

[0102]

[0103] Table 4 shows that the IGWO-GRU algorithm has the best accuracy, false positive rate, and false negative rate among the compared algorithms, indicating its superiority in network anomaly detection. Compared with the GRU algorithm, the IGWO-GRU algorithm improves accuracy by 3.11%, reduces the false positive rate by 2.01%, and reduces the false negative rate by 4.03%, demonstrating that the IGWO-GRU-based network anomaly detection algorithm is superior to the GRU-based algorithm. Among the algorithms, IGWO-GRU has the highest accuracy at 97.62%, while SVM has the lowest at 86.79%. The IGWO-GRU algorithm has the lowest false positive rate at 0.89%, while SVM has the highest at 4.00%. The IGWO-GRU algorithm has the lowest false negative rate at 1.53%, while BP has the highest at 11.56%.

[0104] To further illustrate that the network anomaly traffic detection algorithm based on IGWO-GRU is superior to the network anomaly traffic detection algorithm based on GRU. Figure 3 The convergence and accuracy curves of the two algorithms were compared. The convergence curves show that the IGWO-GRU algorithm converges faster and achieves better convergence. The accuracy curves also show that the IGWO-GRU algorithm converges faster, and compared to the GRU algorithm, it has higher accuracy, lower volatility, and is more stable.

[0105] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0106] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0110] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting abnormal network traffic, characterized in that, include: Step 1: Initialize the gray wolf population information and convergence factor in the gray wolf algorithm. First coefficient vector and The location information of the gray wolf includes the number of hidden layer neurons. and network learning rate ; Step 2: Count the number of hidden neurons in the gray wolf's location information. and network learning rate The model is trained using the training set and fed into a gated recurrent unit (GRU) network. The construction process of the GRU network is as follows; 2.1 Capture industrial control network traffic data and divide the data into training set and test set; wherein the training set is used to fit the model classifier parameters, and the test set is used to test the performance of the model classifier. 2.2 The training set and test set are limited to a certain range by a normalization function to obtain the normalized training set and test set; 2.3 Determine the structure of the GRU network, which includes an input layer, hidden layers, and an output layer; input the normalized training set into the GRU network for parameter training; wherein the GRU network parameters include the learning rate, the number of hidden layers, and the number of hidden layer neurons; the output layer uses softmax as the activation function, and the output result is a traffic prediction classification label for a certain class; 2.4 Train the GRU network, using cross-entropy as the loss function for multi-class classification tasks, and change the network weights through backpropagation; in, It refers to the number and types of abnormal traffic. These are real category tags. It is the output of the GRU network, namely the predicted classification traffic label; 2.5 The trained GRU network was validated using a normalized test set to evaluate the accuracy of the model classifier; Step 3: The accuracy of the test set through the GRU network is used as the fitness of individual gray wolves; and the average fitness of the gray wolf population is calculated. Step 4: When the fitness of the current individual gray wolf is greater than the average fitness, update the gray wolf's position information and parameters using the Gray Wolf Optimization Algorithm (GWO). , and The value is not specified; otherwise, the improved gray wolf optimization algorithm IGWO is used to update the gray wolf location information and parameters. , and The value; when updating location information. and The value changes accordingly; The specific steps of step four are as follows; 3.1 Update parameters , Value: ， in, The fitness of individual gray wolf i; Average fitness; It is the maximum number of iterations; This is the current iteration number; and It is a coefficient vector; It is the convergence factor; and yes Random vectors between; 3.2 Update the location of the Grey Wolves : ， in, , and These are the top three individuals in terms of fitness, and the remaining individuals are... ; , and Represent , and Current location information; , and They represent other individuals in the gray wolf population and , and The distance between them , , These represent the directions the individual gray wolves are facing. , and The distance of movement; , and It is a random vector. This represents the current position of the individual gray wolf; ,in , and for , and The fitness of; Step 5: When the maximum number of iterations is reached, output the IGWO-GRU model and... Location information, the current model is taken as the optimal model, from Obtained from location information and Find the optimal value; otherwise, jump to step two until the iteration is complete, and then output the model and... Location information; the optimal model or output model is used as a model for detecting abnormal network traffic.

2. The network abnormal traffic detection method according to claim 1, characterized in that, The convergence factor First coefficient vector and The initial calculation formula is as follows: in, It is the convergence factor. It is the maximum number of iterations. This is the current iteration number.

3. The network abnormal traffic detection method according to claim 1, characterized in that, The normalization process in step 2.2 uses min-max normalization, and the normalization result is mapped to... between; Industrial control network traffic data Each column is processed using the min-max normalization method, where Max represents the maximum value in a column and Min represents the minimum value in a column.

4. The network abnormal traffic detection method according to claim 1 or 3, characterized in that, The softmax function in step 2.3 maps all the output results of the output layer neurons to... Within the interval, and the sum of all results is 1, the softmax function assigns a probability value to each output classification result, representing the likelihood of belonging to each category, and selects the one with the highest probability as the final predicted classification label; in, represents the output value of the i-th node, and j is the number of output nodes, i.e., the number of categories.

5. A network abnormal traffic detection device employing the network abnormal traffic detection method according to claim 1, characterized in that, include: The network module is used to store the GRU network module and the IGWO-GRU network model. Memory, used to store network traffic data and computer programs; A processor is configured to execute a computer program stored in the memory, wherein, when the computer program is executed, the processor is configured to: Initialize the gray wolf population information and convergence factor in the gray wolf algorithm. First coefficient vector and The location information of the gray wolf includes the number of hidden layer neurons. and network learning rate ; The number of hidden layer neurons in the gray wolf location information and network learning rate The model is trained using the training set and fed into the gated recurrent unit (GRU) network module. The accuracy of the test set through the GRU network module is used as the fitness of individual gray wolves; and the average fitness of the gray wolf population is calculated. When the fitness of a single gray wolf is greater than the average fitness, the Gray Wolf Optimization Algorithm (GWO) is used to update the gray wolf's position information and convergence factor. First coefficient vector and The value is not specified; otherwise, the improved gray wolf optimization algorithm IGWO is used to update the gray wolf location information and parameters. , and The value; when updating location information. and The value changes accordingly; When the maximum number of iterations is reached, output the IGWO-GRU model and Location information, the current model is taken as the optimal model, from Obtained from location information and Find the optimal value; otherwise, continue model training until the iteration is complete, and then output the model and... Location information; the optimal model or output model is used as a model for detecting abnormal network traffic.

6. The network abnormal traffic detection device according to claim 5, characterized in that, The convergence factor First coefficient vector and initialization The formula is as follows: in, It is the convergence factor. It is the maximum number of iterations. This is the current iteration number.

Images