Research On Multi-dimensional Network Traffic Anomaly Detection

As the carrier of information transmission,the usage of network traffic increases with the penetration rate of the Internet.While netizens enjoy the convenient communication brought by high-speed traffic,many criminals exploit network loopholes to attack the network,resulting in abnormal traffic flow and causing damage to the people’s economy withserious loss.Due to the uncertainty of network attack behavior,the sudden change of network traffic and the difficulty in identifying the abnormal cause,and the network traffic itself is high-dimensional,complex,and diverse,it is impossible to unify the processing of all dimensions of network traffic.The relationship between network topology information and time-varying information between complex high-dimensional traffic,as well as the hidden correlation between network topology information and time-varying information.In view of the above problems,this paper divides the complex and multi-dimensional network traffic into two parts of time and space for processing separately,and uses CNN to process the spatial feature data and extract the data such as the number of hops from the source IP to the destination host and the transmission protocol of the network traffic,whic can reduce high-dimensional complexity of local information between data;LSTM time memory to extract the temporal characteristics of network traffic data;uses the attention mechanism to adaptively assign weights to deal with the correlation between temporal and spatial features.Therefore,a method based on a two-channel network traffic anomaly detection model for CNN_LSTM is proposed by this paper.However,the CNN model has the problem of difficult selection of hyperparameters when learning the spatial characteristics of network traffic,and artificial parameter adjustment will consume a lot of computing resources.Therefore,a multi-objective evolutionary algorithm that randomly disturbs different population mutation strategies to solve hyperparameter tuning for CNNs is proposed by this paper.The algorithm uses the hyperparameters of CNN as the input of MOEA/D-ADE-levy,and uses the loss function as the fitness function.First,a uniformly distributed weight vector is obtained by using a mixed horizontal orthogonal experiment,and this weight vector is used to improve the cut ratio.The Scheff mechanism decomposes the sub-problems to obtain a uniformly distributed initial population,that is,the initial CNN hyperparameters;secondly,the fitness function obtained by the hyperparameters is divided into excellent individuals,intermediate individuals and poor individuals according to the size,and different mutation strategies are used for different individuals.The mutation factor F and the crossover probability CR adopt an adaptive mechanism to improve the convergence and diversity of the non-dominated solution set;finally,the levy random disturbance is added to the solution set that falls into the local optimum,which increases its global search ability and jumps out of the local optimum.,and after several iterations,the optimal network hyperparameters are obtained.The adjusted CNN model combined with the two-channel network traffic anomaly detection model of LSTM can learn spatiotemporal features,and finally detect network traffic anomalies through the softmax classifier.For the abnormal traffic caused by the attack type identified by the model,measures can be taken in time to prevent the attack and protect the network environment security.This paper compares the correct rate,precision rate and recall rate of the MOEA/D-ADE-levy optimized CNN model and the CNN model without optimization combined with LSTM for network traffic anomaly detection and single network traffic anomaly detection.The correct rate of traffic anomaly detection is higher than several other methods,and the correct rate of model classification is as high as 98.9%.