Network Traffic Anomaly Detection Based On Attention Mechanism

With the rapid development of network information technology,especially the increase of various new terminal devices in the era of intelligent information technology,network attacks have become more frequent and difficult to detect,and it is urgent to strengthen network security defence.Traditional firewall technology can no longer adapt to the new requirements of network security,intrusion detection as an active defence means is favoured by researchers.The use of intrusion detection systems to provide realtime security defence for computer systems and networks,identify anomalous attacks and take protective measures or report them to users as appropriate,provides an effective aid to maintaining network security and reducing attack disasters.There are many difficulties in leveraging machine learning for network traffic anomaly detection,but deep learning provides technical support to achieve better performance of anomaly detection systems.In this paper,we propose a novel traffic anomaly detection model based on the attention mechanism,and investigate it in conjunction with traffic data analysis and processing.The main contributions of this paper are as follows:First,traffic data attacks are complex,with a large variety of data features,and the attack types have different feature correlations,so it is difficult for traditional methods to effectively extract correlations between features.In addition,network attacks are continuous temporal behaviour and traffic data are time-dependent,making it difficult for traditional methods to efficiently process sequential data.The excellent network structure of the attention mechanism can process the sequence data in parallel,and using a multiheaded attention structure for feature extraction of traffic data can better focus on global correlation and improve the recognition of diverse and complex traffic.Secondly,a convolutional feature extraction module PDB based on a dense block structure is designed to perform deep feature extraction.The PDB module can effectively solve the problem of large number of parameters and complex network by combining the dense convolutional block structure in parallel,so that the limited number of network layers can be used to improve the expressiveness of the model,which can be used to solve the problem of simply stacking The problem of large resource overhead brought by multiheaded attention units.Based on this,this paper proposes the A-PDB traffic anomaly detection model to ensure the detection efficiency while effectively saving the resource overhead.Experiments show that this model can achieve better detection results.Finally,the data generation model of this paper is proposed to solve the imbalance problem of actual traffic data.The traditional SMOTE method is susceptible to boundary samples,while GAN is less effective in training when data is sparse.Based on this,this paper optimises the SMOTE algorithm and GAN while setting up different equalisation methods according to the sample scarcity to effectively ensure the quality of sample generation.Experiments show that the method helps to improve the overall classification effect of the model and significantly improves the recognition of a few classes,which facilitates the implementation of protection means in practical applications according to the type of attacks on the right symptoms.