Unbalanced protocol recognition method based on improved residual U-Net

Jisheng WU; Zheng HONG; Tiantian MA

doi:10.11959/j.issn.2096-109x.2024004

您当前的位置：

首页 >

文章列表页 >

Unbalanced protocol recognition method based on improved residual U-Net

Papers | 更新时间：2024-06-03

- Unbalanced protocol recognition method based on improved residual U-Net
- Chinese Journal of Network and Information Security Vol. 10, Issue 1, Pages: 136-155(2024)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024004
  CLC： TP398.08
- Online First：2024-02，
  
  Published：25 February 2024
- 稿件说明：
移动端阅览
Jisheng WU, Zheng HONG, Tiantian MA. Unbalanced protocol recognition method based on improved residual U-Net[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 136-155.
DOI：

Jisheng WU, Zheng HONG, Tiantian MA. Unbalanced protocol recognition method based on improved residual U-Net[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 136-155. DOI： 10.11959/j.issn.2096-109x.2024004.

摘要

随着互联网的不断发展，网络攻击事件不断增多，成为网络安全的巨大挑战。在所捕获网络流量中，恶意流量往往占比较少，即攻击者使用的通信协议往往为少数类协议。当协议数据的类别分布不平衡时，现有协议识别方法能够识别出多数类协议，但是难以准确识别少数类协议。针对这一问题，提出一种基于改进的残差 U-Net 的不平衡协议识别方法，利用新的激活函数和 SE-Net（squeeze-and-excitation networks）改进残差U-Net，提升残差U-Net的特征提取能力。同时采用带权重的Dice损失函数作为协议识别模型的损失函数，少数类协议的识别准确率偏低会导致损失函数的值偏高，进而促使少数类协议主导模型的优化方向。采用所提方法进行协议识别时，首先从网络流量中抽取网络流，经过预处理转化为一维矩阵，利用协议识别模型提取协议数据的特征，进而由Softmax分类器计算输出协议类型。实验结果表明，与对比模型相比，所提协议识别模型能够更为准确地识别少数类协议，同时多数类协议的识别准确率得到了提升。

Abstract

An unbalanced protocol recognition method based on the improved Residual U-Net was proposed to solve the challenge of network security posed by the increasing network attacks with the continuous development of the Internet.In the captured network traffic

a small proportion is constituted by malicious traffic

typically utilizing minority protocols.However

existing protocol recognition methods struggle to accurately identify these minority protocols when the class distribution of the protocol data is imbalanced.To address this issue

an unbalanced protocol recognition method was proposed

which utilized the improved Residual U-Net

incorporating a novel activation function and the Squeeze-and-Excitation Networks (SE-Net) to enhance the feature extraction capability.The loss function employed in the proposed model was the weighted Dice loss function.In cases where the recognition accuracies of the minority protocols were low

the loss function value would be high.Consequently

the optimization direction of the model would be dominated by the minority protocols

resulting in improved recognition accuracies for them.During the protocol recognition process

the network flow was extracted from the network traffic and preprocessed to convert it into a one-dimensional matrix.Subsequently

the protocol recognition model extracted the features of the protocol data

and the Softmax classifier predicted the protocol types.Experimental results demonstrate that the proposed protocol recognition model achieves more accurate recognition of the minority protocols compared to the comparison model

while also improving the recognition accuracies of the majority protocols.

关键词

Keywords

references

FENG W B , HONG Z , WU L F , et al . Review of network protocol recognition techniques [J ] . Journal of Computer Applications , 2019 , 39 ( 12 ): 3604 - 3614 .

ZHANG Z X , LIU Q J , WANG Y H . Road extraction by deep residual U-Net [J ] . IEEE Geoscience and Remote Sensing Letters , 2018 , 15 ( 5 ): 749 - 753 .

HU J , SHEN L , SUN G . Squeeze-and-Excitation Networks [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 7132 - 7141 .

MILLETARI F , NAVAB N , AHMADI S H . V-Net:fully convolutional neural networks for volumetric medical image segmentation [C ] // 2016 fourth International Conference on 3D Vision(3DV) . 2016 : 565 - 571 .

WANG P , LI S H , YE F , et al . PacketCGAN:exploratory study of class imbalance for encrypted traffic classification using CGAN [C ] // Proceedings of 2020 IEEE International Conference on Communications (ICC) . 2020 : 222 - 224 .

HASIBI R , SHOKRI M , DEHGHAN M . Augmentation scheme for dealing with imbalanced network traffic classification using deep learning [J ] . arXiv preprint:1901.00204 , 2019 .

TANG H , LIU D , YAO L S , et al . Feature selection algorithm for class imbalanced internet traffic [J ] . Journal of Electronics ＆ Information Technology , 2021 , 43 ( 4 ): 923 - 930 .

GUPTA N , JINDAL V , BEDI P . CSE-IDS:using cost-sensitive deep learning and ensemble algorithms to handle class imbalance in network-based intrusion detection systems [J ] . Computers ＆ Security , 2022 ,( 112 ): 102499 .

TELIKANI A , GANDOMI A H , CHOO K K R , et al . A cost-sensitive deep learning based approach for network traffic classification [J ] . IEEE Transactions on Network and Service Management , 2022 , 19 ( 1 ): 661 - 670 .

ZHANG Y , CHEN X , GUO D , et al . PCCN:parallel cross convolutional neural network for abnormal network traffic flows detection in multi-class imbalanced network traffic Flows [J ] . IEEE Access , 2019 ( 7 ): 119904 - 119916 .

XIA B H , HAN D Z , YIN X M , et al . RICNN:a ResNet＆Inception convolutional neural network for intrusion detection of abnormal traffic [J ] . Computer Science and Information Systems , 2022 , 19 ( 1 ): 309 - 326 .

RONNEBERGER O , FISCHER P , BROX T . U-Net:convolutional networks for biomedical image segmentation [C ] // 18th International Conference on Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015 . 2015 : 234 - 241 .

HOWARD A , SANDLER M , CHEN B , et al . Searching for mobileNetV3 [J ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . 2019 : 1314 - 1324 .

LIN M , CHEN Q , YAN S C . Network in network [J ] . arXiv preprint:1312.4400 , 2014 .

SHIRAVI A , SHIRAVI H , TAVALLAEE M . Toward developing a systematic approach to generate benchmark datasets for intrusion detection [J ] . Computers ＆ Security , 2012 , 31 ( 3 ): 357 - 374 .

MOUSTAFA N , SLAY J . UNSW-NB15:a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set) [C ] // Proceedings of 2015 Military Communications and Information Systems Conference (MilCIS) . 2015 : 1 - 6 .

Views

105

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on the robustness of convolutional neural networks in image recognition

Architecture design of re-configurable convolutional neural network on software definition

Mining behavior pattern of mobile malware with convolutional neural network

Multi-scale Logo detection algorithm based on convolutional neural network

Based on linear systolic array for convolutional neural network’s calculation optimization and performance analysis

Related Author

Ping YI

Li PAN

Dian LIN

Liming XU

Yunfei XIA

Li ZHANG

Peijie LI

Yueming WU

Related Institution

Information Engineering University

Information Technology Innovation Center of Tianjin Binhai New Area

⁰