Hybrid sampling network flow sample balancing method

Abstract

The invention discloses a mixed sampling network traffic sample balancing method, which comprises the following steps of: firstly, carrying out data preprocessing on network traffic in a CIC IDS-2017 data set, and dividing the network traffic into a training set and a test set; secondly, the training set is subjected to SMOTE oversampling and ENN undersampling processing, Gaussian noise processing is introduced after SMOTE oversampling, and a mixed sampling sample is obtained; and finally, carrying out CNN training on the mixed sampling sample and verifying a training result through a test set to obtain a classification result. According to the method, Gaussian noise is added after SMOTE processing, so that the complexity of data is increased, the generated sample can better reflect various characteristics in real network traffic, and the risk of overfitting is remarkably reduced. According to the method, most of important information is reserved in the ENN, and unnecessary redundant data is reduced, so that the problem of information loss is avoided, and the adaptability of the model to complex network traffic data is improved. And the function of balancing the network flow data is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic analysis, and in particular to a mixed sampling network traffic sample balancing method. Background Art

[0002] With the rapid development of network technology, the sharp increase in network traffic has brought about complex and diverse network attack behaviors, and network security issues are becoming increasingly serious. In order to improve the network system's ability to detect various abnormal behaviors, network traffic analysis has become a key research direction. By analyzing the patterns and characteristics of network traffic, it can help identify potential security threats and take corresponding protective measures.

[0003] In this context, machine learning technology is increasingly used in network traffic analysis, especially through the classification and anomaly detection of network traffic samples, which can improve the automation and intelligence level of network security protection. However, network traffic data is usually seriously unbalanced, that is, normal traffic samples are far more than abnormal traffic samples. This data imbalance will significantly affect the performance of machine learning models, resulting in a decrease in the model's ability to identify a small number of attack-type traffic during training. Therefore, how to balance network traffic data has become an urgent problem to be solved.

[0004] Intrusion detection system is one of the key technologies for network security defense, which aims to detect and defend against malicious activities in the network. Traditional intrusion detection systems are mainly based on misuse detection and anomaly detection. Misuse detection can effectively deal with known threats by identifying known attack patterns, but it is powerless against unknown attacks and new threats. Anomaly detection can detect unknown attacks by establishing a baseline of normal traffic behavior and detecting activities that deviate from the baseline, but it is prone to a high false alarm rate.

[0005] The amount of network traffic data transmission is large and the data is unbalanced. The proportion of attack samples is very small compared to benign samples. Training the deep learning model with attack samples and benign samples will cause the feature information of the minority class attack samples to be overwhelmed by the information of the majority class benign samples, resulting in the model being unable to learn the minority attack samples. Existing oversampling methods usually increase the proportion of minority class samples by simply copying them. Although this method increases the number of minority class samples to a certain extent, since the minority class samples are directly copied without introducing any new information, it is easy to cause the model to become dependent on these repeated samples during training, which in turn causes overfitting problems. The undersampling method balances the data set by randomly deleting majority class samples. Although it can reduce the dominance of the majority class, a large amount of useful information will inevitably be lost by simply deleting majority class samples. Summary of the invention

[0006] The purpose of the present invention is to provide a mixed sampling network traffic sample balancing method to solve the above problems.

[0007] In order to achieve the above object, the technical solution of the present invention is:

[0008] A mixed sampling network traffic sample balancing method, comprising:

[0009] S1. Preprocess the network traffic in the CICIDS-2017 dataset and divide it into training set and test set;

[0010] S2, the training set is processed by SMOTE oversampling and ENN undersampling, and Gaussian noise is introduced after SMOTE oversampling to obtain mixed sampling samples;

[0011] S3. Perform CNN training on the mixed sampling samples and verify the training results through the test set to obtain the classification results.

[0012] As an improvement to the above technical solution, in step S2, the attack traffic of the training set is subjected to SMOTE oversampling to generate new synthetic samples;

[0013] The formula is as follows:

[0014] x new =x i +λ·(x nieghber -x i ) (1)

[0015] Among them, x i Is to generate new samples x new The starting point is a sample point selected from the minority class sample set; x neighbor is x i The neighboring samples randomly selected from the k nearest minority class samples are used as x new Another reference point generated; λ is a random number in the range [0,1] that determines x new The position of x i and x neighbor The ratio between

[0016] Then, Gaussian noise is added to increase the diversity of samples, avoid the generated samples being too concentrated on the points generated by SMOTE interpolation, and help the model generalize better. The formula is as follows:

[0017] x' new =x new +ε (2)

[0018] Among them, ε:N(0,1) is Gaussian noise in normal distribution, x' newEven the expanded samples obtained by oversampling.

[0019] As an improvement to the above technical solution, in step S2, the method of performing ENN undersampling on the training set is: for each sample x i , calculated using the following Euclidean distance formula 3:

[0020]

[0021] Among them, x i and x j There are two samples, x i,l and x j,l is their lth feature, d is the dimension of the sample. Find the k nearest neighbor samples N(x i )={x i1 ,x i2 ,…,x ik};

[0022] Then calculate the multi-category in the nearest sample The calculation formula is as follows:

[0023]

[0024] I(y ij =y) is the indicator function, when y ij When =y, the function value is 1, otherwise it is 0.

[0025] As an improvement to the above technical solution, the number of occurrences of category y in the nearest neighbor samples is calculated for each sample x. i , if the labels of most samples in its k nearest neighbor samples are the same as its label y i If they are different, they are considered as noise or boundary samples and removed.

[0026] CNN training is performed on the mixed sampling samples and the training results are verified by the test set to obtain the classification results.

[0027] As an improvement to the above technical solution, the test set verification in step S3 refers to the robustness evaluation of the CNN training results, using indicators such as accuracy (ACC), recall and F1 score;

[0028] ACC is used to evaluate the classification ability of the model before and after mixed sampling, which is expressed as the following formula 5:

[0029]

[0030] Recall is used to measure the model's ability to identify positive samples and is expressed as the following formula 6:.

[0031]

[0032] F1 provides a more balanced evaluation metric when considering both the precision and recall of the model. It is expressed as the following formula 7:

[0033]

[0034] As an improvement to the above technical solution, the CNN convolutional neural network uses the Adam optimizer, Relu activation function, and cross entropy loss for gradient descent, with a batch size of 128, a learning rate set to 0.0001, and training for 50 epochs.

[0035] The present invention first preprocesses the network traffic in the CICIDS-2017 dataset and divides it into a training set and a test set. In order to deal with the problem of data imbalance, the process uses the ENN method to undersample the majority class samples and delete redundant and misclassified samples. At the same time, the SMOTE method is used to oversample the minority class samples to generate new minority class samples to balance the data set. In order to further improve the diversity of generated samples and prevent overfitting, Gaussian noise is also added to the samples generated by SMOTE. Through this hybrid sampling method combining SMOTE and ENN, the obtained training set is more balanced and can better represent the actual distribution of network traffic. Next, the convolutional neural network (CNN) is used to train the mixed sampled training set, and finally the model is verified by the test set to obtain the classification result.

[0036] Compared with the prior art, the present invention has the following advantages and positive effects:

[0037] 1) Solve the sample duplication problem of the oversampling method: In the traditional oversampling method, directly copying minority class samples can easily lead to model overfitting and cannot effectively process complex network traffic data. The present invention generates new minority class samples by using the synthetic minority oversampling technique SMOTE (Synthetic Minority Over-sampling Technique, SMOTE) instead of simply copying existing samples, thereby increasing the diversity of minority class samples. In order to further enhance the randomness and representativeness of the generated samples, the present invention adds Gaussian noise to the minority class samples generated by SMOTE, increases the complexity of the data, and makes the generated samples more reflective of the diverse features in real network traffic, significantly reducing the risk of overfitting.

[0038] 2) Simple undersampling methods can easily lead to the loss of useful information by randomly deleting majority class samples. The present invention combines the Edited Nearest Neighbours (ENN) method to intelligently undersample majority class samples by deleting those samples that may be misclassified rather than randomly deleting them. This sample neighborhood-based deletion strategy can reduce unnecessary redundant data while retaining important information of the majority class, thereby avoiding the problem of information loss and improving the model's adaptability to complex network traffic data.

[0039] 3) By combining the SMOTE algorithm with Gaussian noise and the ENN algorithm into a method for dealing with the problem of unbalanced network traffic data, the function of balancing network traffic data is complementarily achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0041] Figure 1 It is the mixed sampling flow chart of the present invention;

[0042] Figure 2 This is a diagram of the CNN model architecture of the present invention;

[0043] Figure 3 It is a schematic diagram of the CNN training curve of the original sample and the mixed sampling sample of the present invention;

[0044] Figure 4 It is a comparison chart of evaluation indicators of original samples and mixed sampling samples of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work, any modifications, equivalent substitutions, improvements, etc., should be included in the protection scope of the present invention.

[0046] This embodiment discloses a mixed sampling network traffic sample balancing method. The mixed sampling method process is as follows: Figure 1 shown.

[0047] First, the network traffic in the CICIDS-2017 dataset is preprocessed and divided into a training set and a test set. In order to deal with the problem of data imbalance, the process uses the ENN method to undersample the majority class samples and delete redundant and misclassified samples. At the same time, the SMOTE method is used to oversample the minority class samples and generate new minority class samples to balance the dataset. In order to further improve the diversity of the generated samples and prevent overfitting, Gaussian noise is also added to the samples generated by SMOTE. Through this hybrid sampling method that combines SMOTE and ENN, the obtained training set is more balanced and can better represent the actual distribution of network traffic. Next, the Convolutional Neural Network (CNN) is used to train the mixed sampled training set, and finally the model is verified by the test set to obtain the classification results.

[0048] 1.1 Hybrid Sampling Method of SMOTE+ENN

[0049] 1.1.1 SMOTE Oversampling

[0050] The gender imbalance problem refers to the situation in which the number of samples of some categories is much smaller than that of other categories in the classification task, which makes the classifier more likely to favor the category with more samples. To solve this problem, SMOTE generates new synthetic samples between the minority category samples, thereby increasing the number of minority category samples and making the dataset more balanced. In addition, Gaussian noise is added to the expanded samples to increase sample diversity. The core formula is used to generate synthetic samples of minority class samples. This formula generates new samples through linear interpolation based on the difference between the selected minority class samples and their neighboring samples. The formula is shown in Equation 1.

[0051] x new =x i +λ·(x nieghber -x i ) (1)

[0052] Among them, x i Is to generate new samples x new The starting point is a sample point selected from the minority class sample set. neighbor is x i The neighboring samples randomly selected from the k nearest minority class samples are used as x new Another reference point generated. λ is a random number in the range [0,1] that determines x new The position of x i and x neighbor The ratio between them.

[0053] Afterwards, the added Gaussian noise can increase the diversity of samples, avoid the generated samples being too concentrated on the points generated by SMOTE interpolation, and help the model generalize better. The formula is as follows: Equation 2.

[0054] x' new =x new +ε (2)

[0055] ε~N(0,1) is Gaussian noise in normal distribution, x' new Even the expanded samples obtained by oversampling.

[0056] 1.2.2 ENN undersampling

[0057] ENN is an undersampling method for data cleaning. The main purpose is to improve the performance of the classifier by removing edge or noise samples, especially on imbalanced datasets. ENN can effectively refine data boundaries and reduce the impact of noise samples.

[0058] Since the SMOTE algorithm is random when selecting samples, when performing neighbor interpolation between sample points at the edge of the sample set, some noise data may be generated, causing the sample boundaries to become blurred and unclear. ENN cleans up the noise that may be introduced by edge interpolation, so that the classifier can generalize better on unbalanced data sets.

[0059] Algorithm First, for each sample x i , using the following Euclidean distance.

[0060]

[0061] Among them, x i and x j There are two samples, x i,l and x j,l is their lth feature, d is the dimension of the sample. Find the k nearest neighbor samples N(x i )={x i1 ,x i2 ,…,x ik}.

[0062] Secondly, calculate the multi-category of the nearest neighbor samples The calculation formula is as follows: Equation 4.

[0063]

[0064] I(y ij =y) is the indicator function, when y ij =y, the function value is 1, otherwise it is 0. Calculate the number of times category y appears in the nearest neighbor sample for each sample x i, if the labels of most samples in its k nearest neighbor samples are the same as its label y i If they are different, they are considered as noise or boundary samples and removed.

[0065] 2 Experimental design

[0066] 2.1 Experimental Preparation

[0067] To evaluate the robustness of the model, the CICIDS-2017 dataset is the input data of the intrusion detection system, and the accuracy (ACC), recall and F1 score are used. ACC is used to evaluate the classification ability of the model before and after mixed sampling, which can be expressed as shown in the following formula 5.

[0068]

[0069] Recall is used to measure the model's ability to identify positive samples, as shown in Formula 6 below.

[0070]

[0071] F1 provides a more balanced evaluation metric when considering both the precision and recall of the model.

[0072] As shown in Formula 7 below.

[0073]

[0074] The deep learning model used in the experiment is CNN, and the network architecture is as follows Figure 2 As shown. Use Adam optimizer, Relu activation function, cross entropy loss for gradient descent, Batchsize is 128, learning rate is set to 0.0001, and train for 50 epochs.

[0075] 2.2 Experimental Results and Analysis

[0076] The total number of data in the CICIDS-2017 dataset is 1,667,613. Among them, the largest number of benign samples is 1,352,766, the largest number of attack samples is DDOS attacks, and the smallest number of Heartbleed attack samples is only 11. The dataset has a serious imbalance problem.

[0077] First, the data is cleaned to remove invalid feature data and data rows with missing features. Then, oversampling is performed on minority class samples, that is, attack type traffic with less than 5,000 entries. Through this process, the number of minority class samples is increased to more than 5,000. At the same time, in order to process the benign classification samples that occupy 81% of the data set, the experiment uses an undersampling method to reduce their number to approximately 670,000. This measure helps reduce the risk of overfitting the model to benign samples and ensures that the model does not over-learn non-critical features of benign traffic. The number of samples before and after mixed sampling is shown in Table 1.

[0078] Table 1: Number of sample categories in the CICIDS-2017 dataset

[0079]

[0080] Through this mixed sampling method of undersampling and oversampling, the class ratio of the data set is effectively balanced. This not only avoids underfitting of the model to a few samples, but also prevents overfitting of the majority class samples, thereby improving the generalization ability of the model. The model is trained and evaluated on the mixed sampling data set, and the CNN model is used for training and testing. The training loss and accuracy are shown in Figure 3 . Figure 3 The curve shows that the gradient descent speed slows down after mixed sampling. The reason is that the proportion of benign samples in the original samples is too large, and the model is overfitting the training of benign sample features, and the fitting speed is relatively fast. After mixed sampling, during the training and fitting process, the features of the attack samples that originally accounted for a small number of samples were also learned by the model. Due to undersampling of benign samples, some information in benign samples is lost. The loss function of the mixed samples is lower than that of the original samples after fitting, and the reduction in classification accuracy is within an acceptable range.

[0081] Table 2: Classification accuracy before and after mixed sampling

[0082]

[0083] The experimental results in Table 2 show that among the five categories with the smallest proportion in the original dataset without mixed sampling, only SSH-Patator has 53.49% accurately classified, and the other four attack categories have not been learned by the model. After mixed sampling, among the seven oversampled attack categories, the classification accuracy of the other six attack categories except WebAttack-Brute Force has increased by at least 50%.

[0084] The model precision, recall rate, and F1 value before and after mixed sampling are as follows Figure 4 . Figure 4The experimental results show that the recall rate of mixed samples increased by 24.66% and the F1 value increased by 24.15% while the accuracy rate only decreased by 0.24%. Not only the high accuracy rate for benign traffic is maintained, but the recall rate and F1 value are also significantly improved, which shows that the generalization performance of the model for attack traffic detection has been significantly improved.

[0085] The hybrid sampling network traffic sample balancing method of the present invention combines SMOTE and ENN to address the defects and shortcomings of the existing technology, and introduces Gaussian noise after SMOTE. This innovative technology brings the following significant advantages:

[0086] 1. By generating minority class samples through SMOTE and introducing Gaussian noise, the number of minority class samples is increased while the diversity of samples is effectively increased, reducing the risk of overfitting during model training. Compared with the previous method of simply copying minority class samples, this method can capture the complex characteristics of minority classes in network traffic and avoid overfitting of the model on minority class data. This not only improves the generalization ability of the model, making it more stable in different network environments, but also enhances the ability to detect abnormal network traffic.

[0087] 2. Through the ENN method, the majority class samples are undersampled, which can delete misclassified or redundant majority class samples instead of simply randomly deleting them. This undersampling strategy effectively avoids the serious problem of information loss in the previous undersampling process, retains the key information in the majority class, thereby improving the model's ability to distinguish between normal and abnormal traffic, and further improving classification performance.

[0088] 3. By combining the SMOTE algorithm with Gaussian noise and the ENN algorithm into a method for dealing with the problem of unbalanced network traffic data, the function of balancing network traffic data is complementary.

Claims

1. A mixed sampling network traffic sample balancing method, characterized by: The steps include: S1. Preprocess the network traffic in the CICIDS-2017 dataset and divide it into training set and test set; S2, the training set is processed by SMOTE oversampling and ENN undersampling, and Gaussian noise is introduced after SMOTE oversampling to obtain mixed sampling samples; S3. Perform CNN training on the mixed sampling samples and verify the training results through the test set to obtain the classification results.

2. The mixed sampling network traffic sample balancing method according to claim 1, characterized in that: In step S2, the attack traffic of the training set is subjected to SMOTE oversampling to generate new synthetic samples; The formula is as follows: x new =x i +λ·(x nieghber -x i ) (1) Among them, x i Is to generate new samples x new The starting point is a sample point selected from the minority class sample set; x neighbor is x i The neighboring samples randomly selected from the k nearest minority class samples are used as x new Another reference point generated; λ is a random number in the range [0,1] that determines x new The position of x i and x neighbor The ratio between Then, Gaussian noise is added to increase the diversity of samples, avoid the generated samples being too concentrated on the points generated by SMOTE interpolation, and help the model generalize better. The formula is as follows: x' new =x new +e (2) Among them, ε:N(0,1) is Gaussian noise in normal distribution, x' new Even the expanded samples obtained by oversampling.

3. The mixed sampling network traffic sample balancing method according to claim 1, characterized in that: In step S2, the method of performing ENN undersampling on the training set is: for each sample x i , calculated using the following Euclidean distance formula 3: Among them, x i and x j There are two samples, x i,l and x j,l is their lth feature, d is the dimension of the sample; find the k nearest neighbor samples N(x i )={x i1 ,x i2 ,…,x ik }; Then calculate the multi-category in the nearest sample The calculation formula is as follows: I(y ij =y) is the indicator function, when y ij When =y, the function value is 1, otherwise it is 0.

4. The mixed sampling network traffic sample balancing method as claimed in claim 3, characterized in that: Calculate the number of times category y appears in the nearest neighbor sample for each sample x i , if the labels of most samples in its k nearest neighbor samples are the same as its label y i If they are different, they are considered as noise or boundary samples and removed.

5. The mixed sampling network traffic sample balancing method according to claim 1, characterized in that: As an improvement to the above technical solution, the test set verification in step S3 refers to the robustness evaluation of the CNN training results, using the accuracy ACC, recall Recall and F1 value as indicators; ACC is used to evaluate the classification ability of the model before and after mixed sampling, which is expressed as the following formula 5: Recall is used to measure the model's ability to identify positive samples and is expressed as the following formula 6:. The F1 value provides a more balanced evaluation metric when considering both the precision and recall of the model; it is expressed as the following formula 7:

6. The mixed sampling network traffic sample balancing method as claimed in claim 1, characterized in that: The convolutional neural network trained by the CNN uses the Adam optimizer, Relu activation function, cross entropy loss for gradient descent, the batch size is 128, the learning rate is set to 0.0001, and training is performed for 50 epochs.

Images