Research On Network Traffic Anomaly Detection Methods Based On Deep Learning

With the development of the Internet,network security issues have been receiving increasing attention.As an important part of network security,network traffic anomaly detection can identify malicious traffic in the network and provide effective data support for subsequent security strategies.However,with the development of Internet technology,new types of network attack methods are emerging constantly.In the face of increasingly complex network traffic data,traditional network traffic anomaly detection methods exhibit low traffic recognition accuracy and serious attack omission,and can no longer meet the current requirements of network security.As deep learning technology continues to mature,deep learning-based network traffic anomaly detection methods have been favored by researchers.However,existing methods still have some shortcomings.On the one hand,the number of anomalous traffic in the network is limited,and there is a serious class imbalance problem in network traffic data,which leads to detection models having serious biases,resulting in poor detection results for a small number of categories of abnormal traffic.On the other hand,the volume and feature dimensions of network traffic data are constantly expanding,and existing detection models have difficulty in quickly and effectively extracting key features,making it difficult to meet accuracy and real-time requirements.To address these issues,this paper proposes a network traffic data balancing method based on deep learning algorithms and constructs a network traffic anomaly detection model.On the other hand,the volume and feature dimensions of network traffic data are constantly expanding,and existing detection models have difficulty in quickly and effectively extracting key features,making it difficult to meet accuracy and real-time requirements.To address these issues,this paper proposes a network traffic data balancing method based on deep learning algorithms and constructs a network traffic anomaly detection model.The main work of this paper is as follows:First,in order to address the issue of low detection rate for minority class anomalous traffic due to class imbalance,a hybrid sampling data balancing method called SMOTE-cWGAN-TK is proposed by combining the SMOTE algorithm,Generative Adversarial Networks(GAN),and Tomek-Links algorithm.This method can balance the network traffic dataset and improve the detection performance of the detection model for minority class samples.Then,in order to address the issues of poor accuracy and inadequate generalization of existing detection methods,a network traffic anomaly detection model MGCGA(Multiple-scale Gated Convolutional with Gated self-Attention)is constructed.This model uses a multi-scale gated convolutional network to extract potential local pattern features and temporal features from traffic data,and then use gated attention mechanism to weight the features extracted by the convolutional layer and integrate the weighted features.In addition,designed a progressive self-distillation loss function(PSD Loss)for efficient training of the model.Finally,experimental evaluation is performed using the balanced UNSW-NB15 dataset.The experimental results show that the MGCGA model proposed in this paper has achieved an F1 value evaluation of 90.9%on the UNSW-NB15 test set,and its detection ability is superior to the comparison methods and others research results,and it can better complete the network traffic anomaly detection work.