| With the rapid development of network communication technology,massive amounts of data are generated in real time,accompanied by frequent network attacks,threatening the security of enterprise and user data.Network abnormal traffic detection technology can achieve the detection of abnormal behaviour by extracting the characteristics of network traffic,which is significant for maintaining network security and safeguarding enterprise and user data.Traditional abnormal traffic detection methods rely on manual mining of traffic data association features to determine whether the traffic is abnormal,the main problems are:(1)can not automatically mining data features;(2)ignore the traffic data itself has the spatial and temporal characteristics,resulting in poor judgment.This paper focuses on the application of CNN and LSTM in the field of abnormal traffic detection,transforming the abnormal traffic detection problem into an image classification problem by converting traffic data into greyscale images.The advantages of CNN automatic feature learning and spatial feature extraction and LSTM extraction of data temporal features are exploited to achieve classification and detection of abnormal network traffic.(1)A pre-processing method for network data is proposed,which mainly includes the steps of digitizing symbolic type data,one-hot coding,digital normalization,conversion to greyscale map and boundary filling,etc.The method overcomes the problem that the feature map keeps getting smaller during the CNN convolution operation of image data,which makes it difficult to extract the defects of data features completely.Based on this,a two-dimensional CNN-based anomalous traffic detection model is proposed and established.The model is improved on the basis of the structure of Let Net5,which is achieved by reasonably increasing the network levels,improving the activation function and pooling method,and solving the problems that the traditional anomalous traffic detection methods cannot automatically achieve feature extraction and low detection accuracy.The experimental results show that the two-dimensional CNN-based abnormal traffic detection model is effective in the process of abnormal traffic classification and detection,with an accuracy rate of 92.56%,a completion rate of 99.5%,an F1 value of 83.9% and a kappa value of 80.06%.(2)A two-dimensional CNN anomaly traffic detection model based on LSTM-Attention improvement is proposed and constructed,giving full play to the advantages of CNN and LSTM which are good at mining spatial and temporal features of data respectively,overcoming the problem that traditional anomaly traffic detection methods cannot completely extract spatial and temporal features of data,and introducing an attention mechanism in the LSTM model to solve the information overload problem of while improving the classification efficiency of the network.The results show that compared with the traditional BP neural network and decision tree,the improved LSTM-Attention based 2D CNN abnormal traffic detection model is more effective,with an accuracy rate of 93.08%,a completion rate of98.07%,an F1 value of 84.66% and Kappa value 81.15%.(3)Based on the Python language,a set of network anomaly traffic detection experiment software has been developed,which can classify and detect the network data traffic set.The relevant results output from the system can reflect whether there is anomalous traffic in the traffic data set,and can provide information support for users in the field of network anomaly traffic detection research. |
