Research On Abnormal Network Traffic Detection Technology Based On ResNet-LSTM Model

Without network security,there can be no national security.Network security has been elevated to the level of national strategy.In recent years.with the rapid development of the Internet industry,the Internet has connected people's life,education,medical care,entertainment and other fields into a huge"wisdom network".While greatly promoting the development of the information age,personal information leakage and fraud,information system malicious attack and tampering have emerged behind it.Advanced sustainable threat attack organization endangers national network security,which makes it extremely urgent to enhance national network security protection capability.Network abnormal traffic detection technology has become an important fortress to ensure network security.Traditional abnormal network traffic detection technologies have problems of low accuracy and high false positives.With the rapid growth of network traffic data,deep learning is introduced to accurately and efficiently detect abnormal network traffic.In order to effectively improve the accuracy of abnormal network traffic detection and reduce the false alarm rate,this paper proposes an abnormal network traffic detection model based on ResNet-LSTM.The research work of abnormal network traffic detection technology based on ResNet-LSTM model includes:1.Network abnormal traffic detection theory and technical basis.Firstly,this paper studies the methods of network traffic collection and analysis;Secondly,it analyzes and summarizes five common abnormal behaviors of network traffic;Finally,by studying the application of traditional machine learning model in network abnormal traffic detection,this paper focuses on the analysis of the decision tree algorithm and its feature selection method,naive Bayes thought and its algorithm process,and concludes the advantages and disadvantages of these two machine learning models in the process of network abnormal traffic detection and classification.By studying and analyzing the network structure of convolutional neural network and recurrent neural network in deep learning model,and the process of detection and classification,it is concluded that deep learning model has advantages over traditional machine learning model in network abnormal traffic detection.It lays a foundation for further research on network abnormal traffic detection technology based on deep learning model.2.Network abnormal traffic detection model based on ResNet-LSTM fusion.In this paper,the kernel principal component analysis(KPCA)algorithm is firstly used to mine the nonlinear information contained in the data set by introducing the nonlinear mapping function and further reducing the dimension to improve the operation efficiency.Secondly,the residual network(ResNet)designed in this paper can effectively solve the problems such as large consumption of computational resources,easy over-fitting of the model,gradient disappearance and explosion when the traditional convolutional neural network(CNN)is carrying out abnormal network traffic detection.The advanced characteristics of network traffic were extracted from the ResNet network model to further detect and classify abnormal network traffic.Finally,based on the advantages of Long and short term memory network(LSTM)in dealing with time domain features,this paper designs LSTM network to detect and classify abnormal traffic.Taking the advanced characteristics of network traffic extracted as input parameters of LSTM network for long sequence prediction can effectively solve the problem of difficult input sequence characteristics of LSTM network.In this paper,the CIC-IDS-2017 data set of Canadian Network Security Research Institute was selected for the experimental evaluation of abnormal network traffic detection.The experimental results show that the abnormal network traffic detection model based on ResNet-LSTM deep learning algorithm can effectively improve the accuracy of abnormal network traffic detection and reduce the false alarm rate.By comparing and analyzing the performance indicators of traditional machine learning models,it is concluded that the model proposed in this paper has more advantages in terms of accuracy and false alarm rate.3.Design and implementation of abnormal network traffic detection system.According to the existing abnormal network detection model,combined with the abnormal network traffic detection model based on the fusion of ResNet-LSTM proposed in this paper,the demand analysis and positioning of the abnormal network traffic detection system are carried out.By designing the function module of the system,the network status monitoring and abnormal traffic detection are realized,which provides an effective method for detecting and classifying abnormal network traffic and ensuring network security.