ABNORMAL TRAFFIC DETECTION BASED ON ATTENTION AND BIG STEP CONVOLUTION
Main Article Content
Abstract
The identification of abnormal traffic is essential to network security and service quality. A big-step convolutional neural network traffic detection model based on the attention mechanism is provided as a solution to the significant challenges in abnormal traffic identification caused by feature similarity and the detection model's single dimension. First, the raw traffic is preprocessed and mapped into a two-dimensional grayscale picture after the network traffic characteristics are examined. After that, histogram equalization is used to create multi-channel grayscale pictures. An attention mechanism is then added to give traffic characteristics varying weights in order to improve local features. In order to improve the flaws in convolutional neural networks, including local feature omission and overfitting, pooling-free convolutional neural networks are finally integrated to extract traffic characteristics of various depths. Both a real data collection and a balanced public data set were used for the simulation experiment. The suggested model is contrasted with ANN, CNN, RF, Bayes, and the two most recent models using the widely used method SVM as a baseline. 99.5% accuracy percentage with several classes is achieved experimentally. The best anomaly detection is found in the suggested model. Additionally, the suggested technique performs better in F1, recall, and accuracy than existing models. It is shown that the model is not only effective in detecting things, but also resilient to a variety of complicated contexts.
Downloads
Metrics
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
You are free to:
- Share — copy and redistribute the material in any medium or format for any purpose, even commercially.
- Adapt — remix, transform, and build upon the material for any purpose, even commercially.
- The licensor cannot revoke these freedoms as long as you follow the license terms.
Under the following terms:
- Attribution — You must give appropriate credit , provide a link to the license, and indicate if changes were made . You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
- No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
Notices:
You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation .
No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
References
O. Salman, I. H. Elhajj, A. Kayssi, and A. Chehab, ‘‘A review on machine learning–based approaches for internet traffic classification,’’ Ann. Telecommun., vol. 75, nos. 11–12, pp. 673–710, Dec. 2020.
A. Madhukar and C. Williamson, ‘‘A longitudinal study of P2P traffic classification,’’ in Proc. 14th IEEE Int. Symp. Modeling, Anal., Simulation, Monterey, CA, USA, Sep. 2006, pp. 179–188, doi: 10.1109/MASCOTS. 2006.6.
S. Sen, O. Spatscheck, and D.Wang, ‘‘Accurate, scalable in-network identification of P2P P2P traffic using application signatures,’’ in Proc. 13th Int.
Conf. World Wide Web, New York, MY, USA, May 2004, pp. 512–521.
L. Ding, J. Liu, T. Qin, and H. Li, ‘‘Internet traffic classification based on expanding vector of flow,’’ Comput. Netw., vol. 129, pp. 178–192,
Dec. 2017.
T. Liu, Y. Sun, and L. Guo, ‘‘Fast and memory-efficient traffic classification with deep packet inspection in CMP architecture,’’ in Proc. IEEE 5th Int. Conf. Netw., Archit., Storage, Macau, China, Jul. 2010, pp. 208–217, doi: 10.1109/NAS.2010.43.
N. Cascarano, L. Ciminiera, and F. Risso, ‘‘Optimizing deep packet inspection for high-speed traffic analysis,’’ J. Netw. Syst. Manage., vol. 19, no. 1, pp. 7–31, Mar. 2011.
G. Aceto, A. Dainotti, W. de Donato, and A. Pescape, ‘‘PortLoad: Taking the best of two worlds in traffic classification,’’ in Proc. IEEE Conf. Comput. Commun. Workshops (INFOCOM), San Diego, CA, USA, Mar. 2010, pp. 1–5, doi: 10.1109/INFCOMW.2010.5466645.
L. Vu, C. T. Bui, and Q. U. Nguyen, ‘‘A deep learning based method for handling imbalanced problem in network traffic classification,’’ in Proc. 8th Int. Symp. Inf. Commun. Technol., Dec. 2017, pp. 333–339.
P. Wang, F. Ye, X. Chen, and Y. Qian, ‘‘Datanet: Deep learning based encrypted network traffic classification in SDN home gateway,’’ IEEE Access, vol. 6, pp. 55380–55391, 2018.
J. H. Shu, J. Jiang, and J. X. Sun, ‘‘Network traffic classification based on deep learning,’’ J. Phys., Conf. Ser., vol. 1087, Sep. 2018, Art. no. 062021.
D. Bahdanau, K. H. Cho, and Y. Bengio, ‘‘Neural machine translation by jointly learning to align and translate,’’ 2014, arXiv:1409.0473.
C.Wang, T. Xu, and X. Qin, ‘‘Network traffic classification with improved random forest,’’ in Proc. 11th Int. Conf. Comput. Intell. Secur. (CIS), Shenzhen, China, Dec. 2015, pp. 78–81, doi: 10.1109/CIS.2015.27.
Z. Yuan and C. Wang, ‘‘An improved network traffic classification algorithm based on Hadoop decision tree,’’ in Proc. IEEE Int. Conf. Online Anal. Comput. Sci. (ICOACS), Chongqing, China, May 2016, pp. 53–56,
doi: 10.1109/ICOACS.2016.7563047.
A. V. Phan, M. L. Nguyen, and L. T. Bui, ‘‘Feature weighting and SVM parameters optimization based on genetic algorithms for classification problems,’’ Appl. Intell., vol. 46, no. 2, pp. 455–469, Mar. 2017.
B. Schmidt, A. Al-Fuqaha, A. Gupta, and D. Kountanis, ‘‘Optimizing an artificial immune system algorithm in support of flow-based internet traffic classification,’’ Appl. Soft Comput., vol. 54, pp. 1–22, May 2017.
S. Dong, ‘‘Multi class SVM algorithm with active learning for network traffic classification,’’ Expert Syst. Appl., vol. 176, Aug. 2021, Art. no. 114885.
J. Cao, Z. Fang, G. Qu, H. Sun, and D. Zhang, ‘‘An accurate traffic classification model based on support vector machines,’’ Int. J. Netw. Manage., vol. 27, no. 1, Jan. 2017, Art. no. e1962.
D. Md. Farid, N. Harbi, and M. Zahidur Rahman, ‘‘Combining Naive Bayes and decision tree for adaptive intrusion detection,’’ 2010, arXiv:1005.4496.
G. D’Angelo and F. Palmieri, ‘‘Network traffic classification using
deep convolutional recurrent autoencoder neural networks for spatial–temporal features extraction,’’ J. Netw. Comput. Appl., vol. 173, Jan. 2021, Art. no. 102890.
X. Ren, H. Gu, and W. Wei, ‘‘Tree-RNN: Tree structural recurrent neural network for network traffic classification,’’ Expert Syst. Appl., vol. 167, Apr. 2021, Art. no. 114363