Design And Implementation Of Analysis And Detection Method For Class Imbalanced Network Traffic

With the explosive growth of network traffic and the increasing number of application classes,the number and types of abnormal traffic are also increasing accordingly,and the analysis and detection of network traffic has become one of the important technologies in network management and network security.The existing methods mainly deal with class imbalance at the data,feature and algorithm levels.The data level is to keep the data as balanced as possible by undersampling or oversampling,the feature level is to identify minority classes more accurately by constructing classsensitive features,and the algorithm level is to improve the algorithm to enhance the learning ability of minority classes.Therefore,the study of solving the problems caused by class imbalance helps the accurate detection of minority classes in network traffic analysis and detection,which is important for traffic analysis of network management and anomaly detection of network security.In this paper,we summarize the current research status of class imbalance-oriented network traffic analysis detection schemes,and design DeepFE-FL and DeepFE-UL traffic analysis detection methods to cope with class imbalance at both the feature level and the algorithm level.At the feature level,a deep residual network is used to extract features,a channel attention mechanism is introduced to model features,a categorysensitive feature representation is learned,and features are reconstructed from a global perspective.At the algorithm level,loss functions are selected for class imbalance,and DeepFE-UL uses UniLoss,a loss function designed for class imbalance traffic dataset,and DeepFE-FL uses Focal Loss,a focal loss function with better performance in target detection task considering class imbalance.The results show that the proposed method improves the detection rate and accuracy of a few classes while ensuring the overall accuracy.Further,this paper designs and implements a class imbalance network traffic analysis and detection system based on the above proposed method,which includes functional modules such as user interface module,pre-processing module,model training module and analysis and detection module.The user interface module is responsible for traffic upload and visualization of analysis results,the preprocessing module is responsible for traffic reading and data cleaning,the model training module is responsible for model generation and model updating,and the analysis and detection module is responsible for separation and analysis of normal and abnormal traffic.The comparison tests conducted on the KDD99 dataset show that the system improves the detection rate and accuracy of abnormal traffic under the abnormal detection scenarios with different imbalance levels.