自注意力的多特征网络流量异常检测与分类

皇甫雨婷 李丽颖 王海洲 沈富可 魏同权

摘要：基于特征选择的网络流量异常检测引起了人们广泛的研究兴趣.现有的方案大多通过简单降低流量数据的维度来检测异常，却忽略了数据特征之间的相关性，导致异常流量检测效率低下.为了有效识别各种类型的攻击，首先提出了一种自注意力机制模型来学习网络流量数据多个特征之间的相关性.然后，设计了一种新型的多特征异常流量检测和分类模型，该模型分析了异常流量数据中多特征之间的相关性，达到检测与识别异常网络流量的目的.实验结果表明，与两种基准方法相比，所提出的技术将异常检测和分类的准确率提高了1.65%，并将误报率降低了1.1%.

关键词：网络异常检测;网络异常分类;自注意力;特征选择;多特征相关性

中图分类号：TP393文献标志码：ADOI：10.3969/j.issn.l000-5641.2021.06.016

Enabling self-attention based multi-feature anomaly detection and classification of network traffic

HUANGFU Yuting，LI Liying，WANG Haizhou，SHEN Fuke，WEI Tongquan

（School of Computer Science and Technology，East China Normal University，Shanghai 200062，China）

Abstract：Network traffic anomaly detection based on feature selection has attracted great research interest. Most existing schemes detect anomalies by reducing the dimensionality of traffic data，but ignore the correlation between data features;this results in inefficient detection of anomaly traffic. In order to effectively identify various types of attacks，a model based on a self-attentive mechanism is proposed to learn the correlation between multiple features of network traffic data. Then，a novel multi-feature anomalous traffic detection and classification model is designed，which analyzes the correlation between multiple features of the anomalous traffic data and subsequently identifies anomalous network traffic. Experimental results show that，compared to two benchmark methods，the proposed technique increased the accuracy of anomaly detection and classification by a maximum of 1.65% and reduced the false alarm rate by 1.1%.

Keywords：network anomaly detection;network anomaly classification;self-attention;feature selection;multi-feature correlation

0引言

随着数据量的快速增长和网络应用的广泛使用，网络安全引起了越来越多专家学者的关注.在网络流量中，异常现象是安全问题的主要症状[1].通常情况下，网络异常指的是行为和模式与正常网络状态存在偏差.网络异常的因素有多种，包括病毒、蠕虫、黑客入侵、广播风暴、网络流量超载和DDoS攻击等.网络异常会造成网络拥堵、资源分配不均衡、性能下降以及一些安全问题，最终可能导致数据泄露和经济损失[2].例如，2017年，一种名为Wannacry的类似蠕虫的勒索病毒爆发并在全球范围内传播.该病毒对电脑中的图片、程序等文件实施……