| With the widening of network coverage,reduction of network access costs,and convenient network communication methods,more and more people have begun to join the virtual world of the Internet.However,there are various abnormal behaviors and attacks in cyberspace,which bring huge challenges to cyberspace security.Especially in the network social mode has become very popular,social network web node server protection work should be paid attention to,among which various abnormal behavior operations and network attacks lead to information leakage in the server is one of the main threats to the network.Therefore,the subject of network traffic analysis and anomaly detection has gradually attracted the attention of many researchers.The current research on abnormal traffic detection is mainly based on deep learning methods,but the efficiency of traffic detection based on deep learning models and the throughput of the model are not considered enough.At the same time,in the current convolutional neural network,due to its own focus on local feature information.Ignoring the positional relationship information of full features and spatial features,leading to problems such as insufficient recognition.This thesis focuses on the problems described above.The main research work is as follows:?1 A data processing method is proposed,which uses artificial feature engineering to reduce the dimension of the feature vector,and at the same time uses attack frequency to sample the data,and then divides the data stream into segments to improve the detection efficiency of the model and the data throughput per unit time.For the traffic data segment,an abnormal traffic detection model with hierarchical attention mechanism is also proposed.By fusing the feature information of the three levels,the detection ability of the model is improved.And introduce an attention mechanism into it,focusing on the abnormal flow in the data flow segment,so that the limited computing resources can be reasonably utilized.?2 A capsule network traffic detection model based on k-means routing algorithm is proposed,which uses vectorized features to replace the scalar features of traditional neural networks,which can better capture the relationship and details between traffic features,and the capsule is equivariant.At the same time,the proposed k-means routing algorithm is better than the original dynamic routing algorithm,with better robustness,more accurate feature clustering and less test time.Aiming at the capsule network model,the preprocessing method of converting the session data stream into a grayscale image is adopted,which can effectively retain the key information in the traffic data.?3 The data in the experiments in Chapters 3 and 4 of this thesis are all from open source datasets,in order to evaluate and detect malicious traffic and social network application traffic in a real environment using the proposed traffic detection model.According to the existing experimental equipment conditions,this thesis constructs a real-world local area network environment,and conducts penetration attack testing on the network and collects and cleans the traffic generated by social network application software,and obtains a Test?Data for testing.In summary,this thesis conducts an in-depth analysis of the current abnormal traffic detection methods,and builds a hierarchical attention mechanism model and a capsule network based on k-means routing according to different focuses in the detection.It is verified on multiple open source datasets that the proposed traffic detection models have good detection performance.And comparing the data processing methods of Chapter 3 and Chapter 4,it is found that under the same data set and the same model,the data processing of the conversation flow into grayscale is better than the artificial feature engineering.In the end,the capsule network based on k-means routing can effectively identify various types of traffic in Test?Data,and the F-score evaluation reached 99%. |
PDF Full Text Request