An abnormal traffic detection method based on a cycle generative adversarial network and a multi-head self-attention mechanism

Abstract

The application provides an abnormal traffic detection method based on a recurrent generative adversarial network and a multi-head self-attention mechanism. The method comprises the following steps: 1, constructing traffic grayscale image data using network traffic data, and extracting features of the traffic grayscale image by using a recurrent generative adversarial network combined with a data enhancement module; 2, screening features of network traffic data information in the grayscale image by using a multi-head self-attention mechanism to obtain traffic features with relatively high importance, and inputting the traffic features into the recurrent generative adversarial network for data enhancement; and 3, classifying traffic categories of the traffic grayscale image subjected to data enhancement by using a bidirectional time sequence convolutional neural network, so that the abnormal traffic is detected.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network flow detection and relates to an abnormal flow detection method based on a cyclic generative adversarial network and a multi-head self-attention mechanism. BACKGROUND

[0002] With the continuous development of network technology, new network applications have been widely used in life, bringing much convenience to people. Accurately detecting abnormal network flows generated by malicious attacks from a large amount of network flows and accurately determining the attack type can effectively maintain network security.

[0003] In recent years, scholars have used machine learning, deep learning and other technologies to build network intrusion detection systems to detect abnormal network flows. Although these intrusion detection systems can effectively detect some categories of abnormal network flows, they have the problem of low detection accuracy when detecting small-scale abnormal network flows. In a network environment, the scale of normal network flows and some common types of abnormal network flows is usually large, while the number of abnormal network flows generated by new network attacks with strong concealment and strong variability is small, that is, there is a data imbalance problem. The occurrence of the data imbalance phenomenon has brought great challenges to abnormal network flow detection. Therefore, how to overcome the data imbalance problem to accurately detect abnormal network flows has become an important problem to be solved.

[0004] Traditional data imbalance solutions often use oversampling techniques, synthetic oversampling techniques, data augmentation techniques and the like to perform data enhancement on some small number of abnormal network flow categories, thereby solving the small sample network flow anomaly detection problem. These methods mainly solve the data imbalance problem by simply replicating data randomly, generating data using algorithms and randomly transforming data, but have the problem of losing important information in large-scale network flows due to changing the original network flow data distribution or changing the original network flow features, and generating a large number of similar imbalanced network flow samples, often resulting in data overfitting phenomenon. In addition, these traditional data enhancement solutions require a large amount of labeled data when training the detection model, and cannot adapt to the growing detection needs of new network attacks.

[0005] In order to solve the problem that the traditional data imbalance solution cannot fully utilize the structured information of network traffic, an effective countermeasure is to convert network traffic into a gray image form for processing. This way, network traffic is regarded as a separate individual, and the advantages of pixel values can more intuitively reflect the correlation between data, effectively extracting spatial information in network traffic. Among them, the generative adversarial network (GAN) is a common data enhancement model for images, which generates realistic images through the adversarial learning between the generator and the discriminator; in addition, GAN can also generate images with similar features to the original gray image but with more changes by learning the structure and features of the gray image data, thereby preserving the key information of the original image while data enhancing. The use of GAN model helps to solve the problem of network traffic data imbalance, thereby improving the generalization ability of the detection model.

[0006] However, the data enhancement method based on the GAN model is not easy to converge in the image enhancement process and the training process is not stable enough. If there is no additional supervision to impose additional constraints on the image enhancement process, the image enhancement will not be significant to improve the effect of target detection. In addition, the image generation process of the GAN model emphasizes the beneficial control of target detection, but this usually requires additional paired training samples, and these training samples are often difficult to collect. Compared with the GAN model, the CycleGAN model uses unpaired images for image-to-image conversion, which can effectively avoid the defect that the GAN model requires paired samples, improving the practicability and scalability of the method. The CycleGAN model uses the adversarial loss between the generator and the discriminator as the global style loss, and uses the identity mapping loss and the cycle consistency loss as the content loss function. However, the ReLU activation function in the CycleGAN generator will produce zero output for negative values, resulting in the loss of texture or edge information in the image; in addition, the training process based on CycleGAN has stability and convergence problems, especially when dealing with unbalanced class samples, which may require a longer training time, and cannot effectively extract key correlation feature information such as global dependence and long-range dependence, resulting in its inability to effectively process the complex structure and correlation features of network traffic data.

[0007] Based on this, the present application proposes an abnormal traffic detection method CGDA-MHSA based on a cycle generative adversarial network and a multi-head self-attention mechanism C ycle G AN D ata AAugmentation-based Abnormal Network Traffic Detection Method With M ulti- H ead S elf- A ttention Mechanism). First, the CycleGAN generator and discriminator are used for image style conversion; then, a grayscale image data augmentation module is added to the CycleGAN model to improve the learning of the CycleGAN using augmented samples to capture the original feature data distribution of the traffic grayscale image, thereby generating better images; secondly, the activation function in the CycleGAN generator is changed to LeakyReLU, thereby effectively alleviating the problem of sparse gradient and accelerating the convergence of the model; at the same time, a multi-head self-attention mechanism is introduced into the CycleGAN model to capture important features in the augmented network traffic, thereby improving the fine-grained feature representation ability of the network traffic; finally, a bidirectional time series convolutional neural network model is used to detect abnormal traffic. A large number of comparative experiments prove that the abnormal traffic detection method proposed in the application can more accurately detect different categories of abnormal traffic. SUMMARY

[0008] The purpose of the application is to more accurately detect different categories of abnormal traffic by solving the problem of unbalanced network traffic data. To this end, the application proposes an abnormal traffic detection method based on a recurrent generative adversarial network and a multi-head self-attention mechanism.

[0009] The application provides an abnormal traffic detection method based on a recurrent generative adversarial network and a multi-head self-attention mechanism, comprising:

[0010] Step 1, using network traffic data to construct traffic grayscale image data, using a recurrent generative adversarial network combined with a data augmentation module to extract features from the traffic grayscale image;

[0011] Step 2, using a multi-head self-attention mechanism to filter the network traffic data information in the grayscale image to obtain important traffic features, and inputting the important traffic features into the recurrent generative adversarial network for data augmentation;

[0012] Step 3, using a bidirectional time series convolutional neural network to classify the traffic grayscale image after data augmentation by traffic category to realize the detection of abnormal traffic.

[0013] In the first aspect, the specific steps of step 1 are as follows:

[0014] Step 1.1, the network traffic table after preprocessing is constructed to obtain a network traffic grayscale image, and the characteristics are represented in the dimensions of source IP address, destination IP address, time, etc. For the selected network traffic dimensions, the data is grouped and the total amount of traffic, average value and other statistical data of each group are calculated, then the gray levels are defined and different gray levels are assigned to each feature data to form a traffic grayscale image;

[0015] Step 1.2, the correlation between the gray values in the traffic grayscale image is learned to obtain local or overall feature information, and the relationship representation in the form of network traffic gray value is realized; the source domain features and target domain features are extracted by means of CycleGAN model, and the data enhancement module is combined to further enhance the diversity and extraction ability of the extracted features, and then the diverse network traffic space-time features, intensity features, distribution features and abnormal traffic features are obtained.

[0016] In the second aspect, the specific steps of the above step 2 are as follows:

[0017] Step 2.1, using the multi-head self-attention mechanism to focus on the local important network traffic features, so as to perform the de-redundancy operation on the network traffic features and obtain the key network traffic features.

[0018] Step 2.2, input the extracted source domain and target domain features into the generator with LeakyRelu as the activation function to learn and generate samples, and then send them to the discriminator for discrimination and evaluation; through the adversarial game of the generator and the discriminator, sample images with appropriate diversity and quality in the target domain are generated.

[0019] In the third aspect, the specific steps of the above step 3 are as follows:

[0020] Step 3.1, input the feature vector of the network traffic obtained by the feature screening operation into the bidirectional time sequence convolutional neural network BiTCN (Bidirectional Temporal Convolutional Network), capture features of different time scales through multiple convolutional layers of BiTCN, extract higher level abstract features by using the pooling layer of BiTCN, and extract key features by means of the full connection layer of BiTCN;

[0021] Step 3.2, input the correlation features of the network traffic obtained by screening, calculate the loss value in the network traffic training process through the cross-entropy loss function; predefine a threshold and select the optimal loss value smaller than the threshold in the continuous calculation training process, train the model and obtain the training parameters in the model, so as to realize the detection of abnormal network traffic.

[0022] Compared with the prior art, the present application has the following beneficial effects:

[0023] 1. The proposed abnormal traffic detection method based on cycle generative adversarial network and multi-head self-attention mechanism enhances network traffic information in the form of grayscale images in the CycleGAN model, ensuring that the diversity of generated samples is effectively enhanced while reducing feature dimension and model training complexity. In addition, the activation function in the CycleGAN generator is changed from the original ReLU to LeakyReLU, which compensates for the sparse gradient problem and neuron death problem of the ReLU activation function, thereby helping the model to converge faster and enhancing the robustness of the model.

[0024] 2. To address the problem of incomplete extraction of traffic information features due to the inability of image information to effectively capture the contextual relevance of network traffic features, the proposed abnormal traffic detection method based on cycle generative adversarial network and multi-head self-attention mechanism effectively combines data enhancement and detection by adding multi-head self-attention mechanism and bidirectional time series convolutional neural network model. First, important local and global features in the enhanced network traffic are effectively captured during the data enhancement phase. Then, the loss value during the training process is calculated using the cross-entropy loss function in the detection phase. Next, the model is trained using the strategy of selecting a more optimal loss value, thereby better capturing the contextual relevance of network traffic features and more comprehensively understanding the temporal relationships in the data, improving the detection efficiency of abnormal traffic. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 Figure is a general flowchart of the abnormal traffic detection method CGDA-MHSA based on cycle generative adversarial network and multi-head self-attention mechanism.

[0026] Figure 2 Figure is a detailed flowchart of the abnormal traffic detection method CGDA-MHSA based on cycle generative adversarial network and multi-head self-attention mechanism.

[0027] Figure 3 Figure is the information of the abnormal network traffic dataset ISAC218 used in the experimental section of the present invention.

[0028] Figure 4 Figure is the information of the abnormal network traffic dataset ISAC219 used in the experimental section of the present invention.

[0029] Figure 5 Figure is the data enhancement effect of the CGDA-MHSA model proposed in the present invention on the traffic grayscale image dataset, where (a) is the effect on the ISAC218 dataset, and (b) is the effect on the ISAC219 dataset.

[0030] Figure 6is the detection effect of four activation functions (including: ReLU, Elu, PReLU, LeakyReLU) in the CycleGAN generator on the detection performance of abnormal network traffic after data enhancement, where (a) is the effect on the ISAC218 dataset, and (b) is the effect on the ISAC219 dataset.

[0031] Figure 7 is the comparison of the precision (Precision), recall (Recall) and F1 value (F1-measure) of the CGDA-MHSA model and the detection model Unenhanced without data enhancement, the detection model GAN based on generative adversarial network data enhancement, the detection model CycleGAN based on cycle generative adversarial network data enhancement, the detection model WGAN-GP based on WGAN data enhancement with a penalty mechanism, and the detection model BAGAN based on balanced generative adversarial network data enhancement on each class in the ISAC218 dataset.

[0032] Figure 8 is the comparison of the average precision (Precision), average recall (Recall) and average F1 value (F1-measure) of the CGDA-MHSA model and the detection model Unenhanced without data enhancement, the detection model GAN based on generative adversarial network data enhancement, the detection model CycleGAN based on cycle generative adversarial network data enhancement, the detection model WGAN-GP based on WGAN data enhancement with a penalty mechanism, and the detection model BAGAN based on balanced generative adversarial network data enhancement on the ISAC218 dataset.

[0033] Figure 9 is the comparison of the precision (Precision), recall (Recall) and F1 value (F1-measure) of the CCGDA-MHSA model and the detection model Unenhanced without data enhancement, the detection model GAN based on generative adversarial network data enhancement, the detection model CycleGAN based on cycle generative adversarial network data enhancement, the detection model WGAN-GP based on WGAN data enhancement with a penalty mechanism, and the detection model BAGAN based on balanced generative adversarial network data enhancement on each class in the ISAC219 dataset.

[0034] Figure 10The comparison of average precision, average recall and average F1-measure of the CGDA-MHSA model and the detection models Unenhanced, GAN, CycleGAN, WGAN-GP and BAGAN without data enhancement on the ISAC219 dataset. DETAILED DESCRIPTION

[0035] The application will be further described below in conjunction with the accompanying drawings and embodiments, it should be pointed out that the described embodiments are only intended to facilitate the understanding of the application and do not limit the application in any way.

[0036] The application aims at abnormal network traffic and proposes an abnormal traffic detection method based on a recurrent generative adversarial network and a multi-head self-attention mechanism to effectively identify malicious network attack behaviors. The application provides a perfect abnormal network traffic detection framework and conducts sufficient experiments to prove the feasibility and effectiveness of the method.

[0037] As shown in Figure 1 The abnormal traffic detection method based on a recurrent generative adversarial network and a multi-head self-attention mechanism comprises the following steps:

[0038] Step 201 uses network traffic data to construct traffic grayscale image data, and uses a recurrent generative adversarial network combined with a data enhancement module to extract features from the traffic grayscale image.

[0039] The purpose of constructing grayscale image data of network traffic in the embodiment of the application is that the local, global and correlation relationships between network traffics can be represented by grayscale values, which facilitates data enhancement of traffic data in the form of images. Therefore, constructing grayscale image data of network traffic facilitates a series of data enhancement operations such as image processing, image data analysis and traffic global correlation feature extraction.

[0040] Step 2011 constructs network traffic grayscale images from the network traffic table after the preprocessing operation, and uses source IP addresses, destination IP addresses and time as dimensions to represent features. For the selected network traffic dimensions, the data is grouped and the total amount and average value of each group are calculated, and then the grayscale levels are defined and different grayscale levels are allocated to each feature data to form a traffic grayscale image.

[0041] Step 2012 learns the correlation between each gray value in the traffic gray image to obtain local or overall feature information, and realizes the relationship representation of the network traffic gray value form; the CycleGAN model is used to extract the source domain feature and the target domain feature, and the data enhancement module is combined to further enhance the diversity and extraction ability of the extracted features, and then the diverse network traffic space-time feature, intensity feature, distribution feature and abnormal traffic feature are obtained.

[0042] Step 202 uses a multi-head self-attention mechanism to filter the network traffic data information in the gray image to obtain traffic features with strong importance, and inputs them into the cycle generative adversarial network for data enhancement.

[0043] Step 2021 uses a multi-head self-attention mechanism to focus on the local important network traffic features that cause the network traffic to be judged as abnormal traffic, and filters out part of the unimportant network traffic features, thereby performing a de-redundancy operation on the network traffic features, and obtaining the key features of the network traffic.

[0044] Among them, the process of using a multi-head self-attention mechanism to weight the features of the network traffic includes:

[0045] (1) Input the n feature vectors obtained by processing the network traffic through the cycle adversarial network into the multi-head self-attention model, splice the obtained network traffic features through the input layer, and obtain the network traffic feature matrix X.

[0046] X=[x1,x2,...,x n ]

[0047] Among them, x n represents a feature sequence composed of feature vectors, and n is the length of the feature sequence.

[0048] (2) Input the feature matrix X into the embedding layer to map it into three different spaces respectively, thereby obtaining the required Q, K, V matrices, wherein W Q , W K , W V respectively represent randomly obtained space matrices, and I represents the input feature vector.

[0049] Q=W Q *I

[0050] K=W K *I

[0051] V=W V *I

[0052] (3) After obtaining three different space matrices, the attention weight in the feature matrix is calculated, and for each position i, the attention weight a iis obtained by calculating the similarity between the input features using the dot product method, and then normalized by the softmax function.

[0053]

[0054] where Q i , K i is the query vector, the key vector, and d k is the feature dimension, T represents the transpose of the matrix.

[0055] (4) Multi-head self-attention mechanism allows the model to focus on different feature combinations in different feature subspaces by introducing multiple sets of different query (Q), key (K), and value (V) matrices. Each attention head can learn the relevance between different features.

[0056] head i = aiV i

[0057] where head i represents the output of the i-th attention head, and V i is the value vector at position i.

[0058] (5) The multiple attention head outputs obtained by the multi-head mechanism are connected and linearly combined through a linear transformation matrix W o , thereby generating the final output of the multi-head self-attention mechanism. This output contains information from different attention heads, allowing the model to exchange and integrate information in multiple feature representation spaces.

[0059] MultiHead(Q, K, V) = Concat(head1, head2,..., head n ) W o

[0060] Step 2022 inputs the extracted source domain and target domain features into the generator with LeakyRelu as the activation function for learning and generating samples, and then sends them to the discriminator for discrimination and evaluation; through the adversarial game between the generator and the discriminator, sample images with appropriate diversity and quality in the target domain are generated.

[0061] Step 203 uses a bidirectional time series convolutional neural network to classify the traffic grayscale images after data augmentation to achieve traffic classification, thereby detecting abnormal traffic.

[0062] Step 2031 inputs the feature vector of network traffic obtained by the feature screening operation into the bidirectional time series convolutional neural network BiTCN, captures features of different time scales through multiple convolutional layers of BiTCN, extracts higher-level abstract features by using the pooling layer of BiTCN, and extracts key features by means of the fully connected layer of BiTCN;

[0063] Step 2032 inputs the associated features of network traffic obtained by screening, calculates the loss value in the network traffic training process through the cross-entropy loss function, predefines a threshold, and selects the optimal loss value less than the threshold in the continuous calculation training process, trains the model, and obtains the training parameters in the model, thereby realizing the detection of abnormal network traffic.

[0064] The bidirectional time series convolutional neural network BiTCN is a deep learning model for time series data modeling, which combines the characteristics of convolutional neural network CNN and bidirectional recurrent neural network RNN, and can effectively capture patterns and features in time series data. Compared with traditional RNN, BiTCN can not only extract information from past to future, but also extract features from future to past, so as to more comprehensively understand the relationship in time series data. Compared with other classification models, BiTCN has the advantages of capturing time series relationship, avoiding gradient problem, short training time, high accuracy, and strong generalization, so the BiTCN model is selected for network traffic classification. The process of the BiTCN classification stage includes:

[0065] (1) Input the network traffic associated features obtained by step 2031, calculate the loss value in the network traffic training process by using the cross-entropy loss function, predefine a threshold, and select the optimal loss value less than the threshold in the continuous calculation training process, thereby train the model and obtain the training parameters in the model. Specifically, the batch size is 256, the neural network layer is 4, the hidden layer unit is 20, and the iteration number is 10. The bidirectional time series convolutional neural network uses one-dimensional convolutional layer to capture patterns in time series, and the convolutional layer can slide on the time series through sliding window and apply convolution operation on each window. In bidirectional time series convolution, the forward and reverse convolutional layers are connected in series, so that the network can capture forward and backward patterns in time series, which helps to capture abnormal behavior more comprehensively.

[0066]

[0067] where y i is the output of the convolutional layer, x i+j-1 is the element of the input sequence in the window, w i is the weight of the convolution kernel, b is the bias term, f is the activation function, and K is the upper limit of the time step.

[0068] (2) After convolution, a pooling layer is used to reduce the feature dimension, which helps to focus on important features, and the pooling adopts the maximum pooling method.

[0069] h i =max(x i：i+p-1 )

[0070] where h i is the output of the pooling layer, calculated at time step i, x i:i+p-1 is the element of the input sequence in the pooling window, and p is the size of the pooling window.

[0071] (3) The pooled features are sent to a fully connected layer to learn higher-level abstract feature representations. Finally, an output layer is used to predict whether the network traffic is normal.

[0072] z=W x +b

[0073] Output=f(z)

[0074] where z is the output of the fully connected layer, W is the weight matrix, x is the input feature, b is the bias term, Output is the final classification result, and f(z) represents the final output result of z through the activation function Nonlinear transformation.

[0075] Step 2033 inputs the network traffic grayscale data after data enhancement into the neural network model for training, thereby obtaining the final abnormal network traffic detection model.

[0076] The present application mainly detects abnormal network traffic, and uses network traffic data sets ISAC218 and ISAC219 to test the effect. Figure 3 and Figure 4 shows the distribution of the unbalanced data set used in the experiment. Among them, the Dyreza, Ghost_RAT and Ramnit three types of abnormal network traffic in the ISAC218 data set are much smaller than other types of abnormal network traffic, and the Andromeda, Avzhan and BAB0 three types of abnormal network traffic in the ISAC219 data set are much smaller than other types of abnormal network traffic.

[0077] In order to verify the picture generation effect of the data enhancement part of the abnormal traffic detection method CGDA-MHSA based on the recurrent generative adversarial network and the multi-head self-attention mechanism proposed in the present application, part of the generated samples in the above two network traffic data sets are selected for effect display, and the data enhancement effect is as follows: Figure 5As shown in the figure. In addition, in order to verify the effect of CycleGAN modifying the generator activation function to LeakyRelu, Relu, Elu, PReLU and LeakyRelu are used respectively for experiments under three evaluation indexes, and the average recall rate, average precision and average F1-measure of the experiments are as shown in the table Figure 6 .

[0078] In order to verify the detection effect of the application based on the CycleGAN and the multi-head self-attention mechanism, the detection model without data enhancement, the detection model based on the generative adversarial network data enhancement, the detection model based on the CycleGAN data enhancement, the detection model based on the WGAN data enhancement with a penalty mechanism and the detection model based on the BAGAN data enhancement are used for experiments on the two network flow data sets, and the experimental results are as shown in the table Figure 7 , Figure 8 , Figure 9 , Figure 10 . It is found by observation that the accuracy, precision, recall and F1-measure of the CGDA-MHSA model proposed in the application after data enhancement are higher than those of other models. The experimental results not only prove that the data enhancement module can better help CycleGAN to generate better sample images, and the multi-head self-attention mechanism can better learn the feature information with correlation in network flow, but also prove that the combination of the BiTCN detection model in the model is very effective for the detection of abnormal flow.

Claims

1. A method for detecting abnormal traffic based on a cycle generative adversarial network and a multi-head self-attention mechanism, characterized in that, The method comprises the following steps: Step 1, constructing traffic gray scale data using network traffic data, using a cycle generative adversarial network combined with a data enhancement module to extract features of the traffic gray scale; Step 2, using a multi-head self-attention mechanism to filter the network traffic data information in the gray scale to obtain important traffic features, and inputting the important traffic features into the cycle generative adversarial network for data enhancement; Step 3, using a bidirectional time series convolutional neural network to classify the traffic gray scale after data enhancement to detect abnormal traffic; Step 1-1, constructing a network traffic gray scale by preprocessing the network traffic table, and representing the features in the source IP address, destination IP address and time dimension; For the selected network traffic dimension, the data is grouped and the total traffic volume and average statistical data of each group are calculated, then the gray levels are defined and different gray levels are assigned to each feature to form a traffic gray scale; Step 1-2, learning the correlation between the gray values in the traffic gray scale to obtain local or overall feature information, and realizing the relationship representation in the form of network traffic gray values; with the help of the CycleGAN model, source domain features and target domain features are extracted, and a data enhancement module is combined to further enhance the diversity and extraction ability of the extracted features, and then diverse network traffic spatiotemporal features, intensity features, distribution features and abnormal traffic features are obtained; The specific implementation of step 3 comprises the following steps: The traffic gray scale samples generated by CycleGAN are input into the bidirectional time series convolutional neural network BiTCN, the features of different time scales are captured through multiple convolutional layers of BiTCN, higher level abstract features are extracted through the pooling layer of BiTCN, and key features are extracted through the full connection layer of BiTCN, and finally the loss value in the training process is calculated through the cross-entropy loss function; a threshold value is predefined and the optimal loss value smaller than the threshold value is selected in the continuous calculation training process, so as to train the model and obtain the training parameters in the model; specifically, the batch size is 256, the neural network layer is 4, the hidden layer unit is 20, and the iteration number is 10, so as to realize the detection of abnormal traffic.

2. The abnormal traffic detection method according to claim 1, characterized by, The specific implementation of step 2 comprises the following steps: Step 2-1, using a multi-head self-attention mechanism to focus on local important network traffic features, so as to perform a de-redundancy operation on the network traffic features and obtain key network traffic features; Step 2-2, inputting the extracted source domain and target domain features into the generator with LeakyRelu as the activation function to learn and generate samples, and then sending the samples to the discriminator for discrimination and evaluation; Through the adversarial game of the generator and the discriminator, sample images with appropriate diversity and quality in the target domain are generated.

Images