Multidimensional Feature Analysis And Detection Of Abnormal Network Behavior Based On Deep Learning

With the rapid development of the Internet,all kinds of online attacks are emerging,and the network security field has received more and more attention,and the country also has invested many research.As an extremely important part of the network abnormality detection system,network traffic classification task plays an important role in the field of network security.At the same time,with the successful application of deep learning technology in computer vision,natural language processing and other fields,researchers have also begun to apply deep learning to traffic classification tasks.Many existing deep learning-based traffic classification methods convert network traffic data into image data and input them into the network for classification.This paper aims to apply different deep learning models to traffic classification,extract features of network traffic from multiple perspectives and analyze them to achieve better classification performance.In addition,this paper will leverage deep learning models to implement data augmentation to address the imbalance of traffic datasets.The main work of this paper is as follows:1.A network abnormal behavior detection algorithm based on frequency statistical features is proposed.From the perspective of frequency characteristics,the algorithm uses the N-gram model to extract N-gram segments from the original hexadecimal data sequence of traffic data.Then,the most important n segments are selected by feature selection technology,and the frequency of occurrence of each segment in each flow data is calculated separately to characterize the frequency characteristics of traffic data,and finally combined with convolutional neural network to achieve higher classification accuracy.2.A network abnormal behavior detection algorithm based on graph convolution and encoder is proposed.The algorithm proposes to treat network traffic as a special language to extract its time-series features.First,the graph convolutional network is used to extract the global information of 256 single-byte hexadecimal data in the entire dataset,and then generate global embeddings.Secondly,the algorithm uses the encoder in the Transformer structure as the feature extractor,and the global embeddings are added to the input embeddings to enrich the information of the traffic data,and finally obtains better classification performance.3.A variational autoencoder-based unbalanced traffic data identification algorithm is proposed.The algorithm also treats network traffic as a special language and feeds it into a variational autoencoder model to train and learn data features.Finally,the generated model obtained by training can randomly generate hexadecimal sequence data,that is,the original network traffic data,to realize the data enhancement of the network traffic dataset,and then improve the classification performance of the model for the minority data.