Research On Classification And Visualization Of Network Traffic Based On ResNet

In recent years,in order to respond to malicious attacks that frequently occur in the network,experts and scholars at home and abroad have developed a variety of response solutions,of which network traffic anomaly detection is widely used.This method can determine the source of traffic by detecting the attributes of the traffic,and then accurately identify virus attacks and intrusions,providing important support for the computer to take defensive measures in time.The network traffic classification that this article will discuss is a key step in anomaly detection and an effective method to identify attacks and intrusions.The principle is to classify known traffic first,establish a safe list and an abnormal list,when traffic enters the host,use the classification system to detect its category,and then determine whether it is safe traffic or abnormal traffic.At present,most of the network traffic classification methods adopt the traditional threestep model,that is,first obtain network traffic through a packet capture tool,then design and analyze the statistical characteristics of the traffic,and finally use machine learning algorithms to train the classifier.This method has two shortcomings.One is that the classification performance depends on the quality of the traffic feature design.However,the amount of data generated by the Internet nowadays is increasing,and the structure is becoming more and more complex..And for traffic from different sources,it is necessary to design corresponding feature sets separately,which consumes a lot of manpower and time.The second is that the step-by-step process is not real-time.If you want to classify the traffic,you must wait for the complete transmission of the traffic to extract the statistical features and perform further analysis,so that the best detection time for the traffic is missed.Based on the above two shortcomings,this article has launched a research on how to apply deep learning technology to the field of network traffic classification.The specific idea is to use deep learning to replace manual design of traffic feature sets,and to construct an endto-end classification model.At the same time,the appearance characteristics of the flow data are used instead of the statistical characteristics as the basis for classifying the flow.In this way,one-dimensional traffic data needs to be converted into two-dimensional data,so that images can be generated and the traffic classification problem can be converted into an image classification problem.Finally,in order to verify whether the classification model can accurately identify the image generated by the two-dimensional data and explore its classification basis,a visual analysis of the neural network is done.The main innovative work and research results obtained are as follows:1.Propose a network traffic classification model based on deep convolutional neural network Res Net-18,and design multiple sets of controlled experiments for experimental verification.The results show that the model's classification accuracy,precision rate,recall rate and F1 value and other evaluation indicators all exceed the best existing methods and reach the level of practical application.At the same time,the model is based on an end-to-end model,using a trained classifier to detect new incoming unknown traffic in real time,and directly obtain the final recognition result based on the original data without additional processing.This method fully makes up for the shortcomings of the existing traffic classification scheme based on classic machine deep learning algorithms.It proves the feasibility and effectiveness of deep learning technology represented by convolutional neural network in the field of network traffic classification.2.Using the method of data dimension transformation and class activation mapping,the convolutional neural network was visualized and analyzed,and the grayscale map and class activation mapping response map corresponding to the original traffic data were obtained.In addition,the research ideas of this article and the rationality of using convolutional neural networks to complete the task of traffic classification are elaborated.After processing,each one-dimensional data can generate a two-dimensional grayscale image.Different types of traffic have their own unique grayscale images.The abstract statistical characteristics of the string data are transformed into the concrete representation of the picture,which is so complicated the problem of traffic classification is transformed into a simple and intuitive image classification problem.The class activation mapping response diagram clearly shows the classification basis of the Res Net-18 network for grayscale images,allowing people to intuitively see how the model recognizes and classifies grayscale images,and is also for this kind of focus on representation learning the network traffic classification method provides theoretical support.