Research On Network Traffic Anomaly Detection Based On CapsNet

With the rapid development of information technology,the Internet has gradually become an indispensable part of people's production and life,and at the same time,many cyberspace security problems have become increasingly prominent.Network traffic anomaly detection is an important direction of network security researches.Based on Capsule Network(CapsNet),this thesis studies network traffic anomaly detection algorithms,and proposes a network traffic anomaly detection model based on SMOTETomek hybrid-sampling and Capsule Network.The main research work of this thesis is as follows:Firstly,the working principle,algorithm architecture and optimization algorithm of capsule network are analyzed,and a network traffic anomaly detection model based on CapsNet is proposed.By using CapsNet's stronger feature extraction effect on images,the data of the dataset is imaged.And we use control variables to set up different groups of control experiments to tune the hyperparameters in the model.The experimental results in the dataset show that the average recall of the anomaly detection model based on CapsNet is 0.9606,and the average Macro F1-score is 0.8933,which is improved compared with other algorithms.Then,aiming at the problem of imbalanced dataset,the hybrid-sampling method is used to make the sample data tend to be balanced,and a network traffic anomaly detection model based on SMOTE-Tomek hybrid-sampling and Capsule Network(ST-CapsNet)is proposed.As a hybrid-sampling method,ST-CapsNet has a significant effect on improving the detection ability of minority classes in imbalanced dataset.CapsNet is not optimized for imbalanced dataset,which will limit its detection performance in imbalanced dataset.ST-CapsNet proposed in this thesis integrates the SMOTE-Tomek hybrid-sampling method in the image processing stage of the data set to improve the detection ability of minority classes.Finally,the experiments are carried out on the KDD cup 99 dataset to verify the effectiveness of the model in the multi classification problem.Use a number of different evaluation indicators as the evaluation criteria for model performance,including precision rate,recall rate,F1-score,etc.The experimental results in the KDD CUP 99 dataset show that the average Macro F1-score of the ST-CapsNet proposed in this paper is 0.9282,which is an increase of 0.0349 compared with CapsNet.Compared with other deep neural networks,ST-CapsNet also has a good performance.