Research On Attack Feature Analysis And Detection Method Based On Network Traffic

With the popularization of computers and the rapid development of the Internet,network technology has been widely applied in various fields of society,but it has also brought new network security challenges.Early passive defense methods such as firewall technology and encryption technology were no longer effective in dealing with large-scale traffic data.Intrusion detection technology is an important method for protecting network and information security.With the development of deep learning technology,combining deep learning theory with network intrusion detection technology can improve the timeliness and accuracy of large-scale traffic data detection.This paper takes network traffic as the research object,summarizes the relevant theories of intrusion detection and deep learning based intrusion detection,and analyzes the attack characteristics and various detection methods of network traffic in detail.It studies the cyclic neural network(RNN)and the long and short term memory network(LSTM),including the network structure and related algorithms.In the experiment,the LSTM detection model was built to train network traffic data for intrusion detection.The 10% subset of KDD Cup99 was used as the experimental data.The results showed that the number of attack categories correctly identified by LSTM model was higher than that of BP neural network.Clockwork recurrent neural network(CW-RNN)is an improved structure of RNN.In this paper,an improved scheme is proposed for CW-RNN.An experimental analysis of intrusion detection based on improved CW-RNN is carried out,and several prediction indexes of BP neural network,LSTM network and improved CW-RNN model are statistically compared.Through comparison,it was found that the improved CW-RNN model has a high detection rate for U2 R in the KDD Cup99 dataset,especially in rare attack types based on traffic features.The Time complexity of the improved CW-RNN network training is greatly reduced due to the selective participation of the internal units of the hidden layer in the operation,which makes the training speed significantly improved,and the Rate of convergence is also higher than the original CW-RNN model.In order to verify the actual detection capability of the model,Vue and Python are used to build a set of fully functional intrusion detection prototype system based on network traffic characteristics,which has certain engineering application value.