基于迁移学习的跨域异常流量检测

doi:10.13190/j.jbupt.2020-114

北京邮电大学学报 ›› 2021, Vol. 44 ›› Issue (2): 33-39.doi: 10.13190/j.jbupt.2020-114

• 未来网络体系架构和关键技术专题 • 上一篇下一篇

基于迁移学习的跨域异常流量检测

彭雨荷, 陈翔, 陈双武, 杨坚

中国科学技术大学信息科学技术学院, 合肥 230026

收稿日期:2020-08-04 出版日期:2021-04-28 发布日期:2021-04-28
通讯作者: 陈双武(1988-),男,副研究员,E-mail:chensw@ustc.edu.cn. E-mail:chensw@ustc.edu.cn
作者简介:彭雨荷(1996-),女,硕士生.
基金资助:
国家重点研发计划项目（2018YFF01012200）；中央高校基本科研业务费专项资金项目（WK2100000009）；安徽省自然科学基金项目（1908085QF266）

Cross-Domain Abnormal Traffic Detection Based on Transfer Learning

PENG Yu-he, CHEN Xiang, CHEN Shuang-wu, YANG Jian

School of Information Science and Technology, University of Science and Technology of China, Hefei 230026, China

Received:2020-08-04 Online:2021-04-28 Published:2021-04-28

摘要/Abstract

摘要： 基于已知数据的机器学习模型在实际异常流量检测任务中不完全可靠，为此，将不同分布的流量分别作为源域和目标域，建立跨域网络异常流量检测框架，提出了基于联合分布适配的迁移学习方法.通过寻找最优变换矩阵、适配源域与目标域之间的条件概率和边缘概率，实现源域与目标域间的特征迁移，从而解决由于源域与目标域分布差异大所引起的检测准确率下降等问题.实验结果表明，所提方法可以显著提升跨域流量的检测准确率.

关键词: 异常流量检测, 跨域, 迁移, 联合分布适配, 机器学习

Abstract: In order to solve the problem that the machine learning model based on known data is not completely reliable in actual abnormal traffic detection tasks due to the dynamics of the network environment. The different distributed traffic as the source domain and target domain is used to establish a cross-domain framework for abnormal network traffic detection. The transfer learning method based on joint distribution adaptation is proposed by finding the optimal transformation matrix, adapting the conditional probability and edge probability between the source domain and the target domain, the feature transfer between the source domain and the target domain is realized thereby for solving the problem of the large difference in the distribution of the source domain and the target domain causes problems such as decreased detection accuracy. Experiments show that the proposed method can significantly improve the detection accuracy of cross-domain traffic.

Key words: abnormal traffic detection, cross-domain, transformation, joint distribution adaptation, machine learning

中图分类号:

TP393.08

彭雨荷, 陈翔, 陈双武, 杨坚. 基于迁移学习的跨域异常流量检测[J]. 北京邮电大学学报, 2021, 44(2): 33-39.

PENG Yu-he, CHEN Xiang, CHEN Shuang-wu, YANG Jian. Cross-Domain Abnormal Traffic Detection Based on Transfer Learning[J]. Journal of Beijing University of Posts and Telecommunications, 2021, 44(2): 33-39.

参考文献

[1] Cisco V. Cisco visual networking index:forecast and trends, 2017-2022[R]. San Jose:[s.n.], 2018:1-38.
[2] Ahmed M, Mahmood A N, Hu J. A survey of network anomaly detection techniques[J]. Journal of Network and Computer Applications, 2016(1):19-31.
[3] Li C, Gu Z, Zhou M, et al. API misuse detection in C programs:practice on SSL APIs[J]. International Journal of Software Engineering & Knowledge Engineering, 2019, 29(11):1761-1779.
[4] 吉星, 黄韬, 鄂新华, 等. 基于日志信息的DNS查询异常检测算法[J]. 北京邮电大学学报, 2018, 41(6):83-89. Ji Xing, Huang Tao, E Xinhua, et al. A DNS query anomaly detection algorithm based on log information[J]. Journal of Beijing University of Posts and Telecommunications, 2018, 41(6):83-89.
[5] Du Z, Ma L, Li H, et al. Network traffic anomaly detection based on wavelet analysis[C]//2018 IEEE 16th International Conference on Software Engineering Research, Management and Applications (SERA). Kunming:IEEE, 2018:94-101.
[6] Wang M, Cui Y, Wang X, et al. Machine learning for networking:workflow, advances and opportunities[J]. IEEE Network, 2017, 32(2):92-99.
[7] Almseidin M, Alzubi M, Kovacs S, et al. Evaluation of machine learning algorithms for intrusion detection system[C]//2017 IEEE 15th International Symposium on IntelLigent Systems and Informatics (SISY). Subotica:IEEE, 2017:277-282.
[8] Sharafaldin I, Lashkari A H, Ghorbani A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C]//ICISSp. Portugal:SciTePress, 2018:108-116.
[9] Canadian Institute for Cybersecurity. CSE-CIC-IDS2018 on AWS[DB/OL]. Canadian:University of New Brunswick, 2019:1-1[2020-04-01]. https://www.unb.ca/cic/datasets/ids-2018.html.
[10] Pan S J, Yang Q. A survey on transfer learning[J]. IEEE Transactions on Knowledge and Data Engineering, 2009, 22(10):1345-1359.
[11] Long M, Wang J, Ding G, et al. Transfer feature learning with joint distribution adaptation[C]//Proceedings of the IEEE International Conference on Computer Vision. Sydney:IEEE, 2013:2200-2207.
[12] Pan S J, Tsang I W, Kwok J T, et al. Domain adaptation via transfer component analysis[J]. IEEE Transactions on Neural Networks, 2010, 22(2):199-210.

[1]	常霄, 黄智濒, 禹旻, 杨武兵. 一种适用于航天大数据的深度决策树算法[J]. 北京邮电大学学报, 2023, 46(3): 1-6.
[2]	黄韬谈沙唐琴琴谢人超张然. 面向分布式云的广域超融合网络：愿景与关键技术[J]. 北京邮电大学学报, 2023, 46(2): 1-8.
[3]	欧阳莫微, 康桂霞, 王开亮, 王亚明. 一种放射组学分析的海马硬化自动诊断方法[J]. 北京邮电大学学报, 2022, 45(4): 51-57.
[4]	牟晓惠, 李丽香. Dropout回声状态网络的网络流量预测[J]. 北京邮电大学学报, 2021, 44(5): 10-13,20.
[5]	汤永利, 李星宇, 赵宗渠, 李运峰. 面向Android支付破解应用的检测方法[J]. 北京邮电大学学报, 2021, 44(4): 95-101.
[6]	邓筱, 徐梦秋, 吴铭, 张闯. 基于语义分割的织锦类自适应风格迁移算法[J]. 北京邮电大学学报, 2021, 44(1): 117-123.
[7]	吕兴凤, 李金宝. 一种利用随机森林方法检测睡眠呼吸暂停的研究[J]. 北京邮电大学学报, 2020, 43(5): 64-70.
[8]	张德干, 陈露, 陈晨, 张婷, 崔玉亚. 一种面向边缘计算节点能量优化的QoS约束路由算法[J]. 北京邮电大学学报, 2020, 43(4): 101-105.
[9]	周怡琳, 杨璐, 鲁文睿. 尘土颗粒影响下电路板电化学迁移失效寿命建模探索[J]. 北京邮电大学学报, 2020, 43(3): 11-18,31.
[10]	孙浩, 陈岚, 郝晓冉, 刘晨吉, 倪茂. 一种面向边缘计算的混合内存系统[J]. 北京邮电大学学报, 2020, 43(2): 103-109.
[11]	张国栋, 应欢, 杨寿国, 石志强, 李霁远. 嵌入式固件脆弱哈希函数自动识别与破解方法[J]. 北京邮电大学学报, 2020, 43(1): 46-53.
[12]	余凯祥, 陈振豪, 张四海. 一种多变量制造过程中的关键变量检测算法[J]. 北京邮电大学学报, 2019, 42(6): 98-104.
[13]	赵国喜, 金顺福, 马聪变, 曹建宇, 许利军. 服务台数量可变的云服务系统分析[J]. 北京邮电大学学报, 2019, 42(4): 114-120.
[14]	孟浩, 霍如, 郭倩影, 黄韬, 刘韵洁. 基于机器学习的MEC随机任务迁移算法[J]. 北京邮电大学学报, 2019, 42(2): 25-30.
[15]	崔鸿雁, 徐帅, 张利锋, Roy E. Welsch, Berthold K. P. Horn. 机器学习中的特征选择方法研究及展望[J]. 北京邮电大学学报, 2018, 41(1): 1-12.

基于迁移学习的跨域异常流量检测

Cross-Domain Abnormal Traffic Detection Based on Transfer Learning

RichHTML

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

本文评价