小样本下基于度量学习的僵尸网络检测方法

林宏刚; 朱竣菁; 陈麟

doi:10.11959/j.issn.2096-109x.2023076

您当前的位置：

首页 >

文章列表页 >

小样本下基于度量学习的僵尸网络检测方法

学术论文 | 更新时间：2024-06-03

- 小样本下基于度量学习的僵尸网络检测方法
- Metric-based learning approach to botnet detection with small samples
- 网络与信息安全学报 2023年9卷第5期页码：33-47
- 作者机构：
  
  1. 成都信息工程大学网络空间安全学院，四川成都 610225
  2. 先进密码技术与系统安全四川省重点实验室，四川成都 610225
  3. 网络空间安全态势感知与评估安徽省重点实验室，安徽合肥 230037
- 作者简介：
  
  [ "林宏刚（1976−），男，四川资阳人，成都信息工程大学教授，主要研究方向为物联网安全、网络与系统安全" ]
  [ "朱竣菁（1998−），女，四川达州人，成都信息工程大学硕士生，主要研究方向为网络空间安全" ]
  [ "陈麟（1973− ），男，重庆忠县人，网络空间安全态势感知与评估安徽省重点实验室教授，主要研究方向为网络空间安全" ]
- 基金信息：
  
  国家242信息安全计划;TheNational 242 Information Security Plan(2021-037);网络空间安全态势感知与评估安徽省重点实验室开放课题;Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation Open Project(CSSAE-2021-002)
- DOI：10.11959/j.issn.2096-109x.2023076
  中图分类号： TP309.5
- 网络首发：2023-10，
  
  纸质出版：2023-10-25
- 稿件说明：
移动端阅览
林宏刚, 朱竣菁, 陈麟. 小样本下基于度量学习的僵尸网络检测方法[J]. 网络与信息安全学报, 2023,9(5):33-47.

Honggang LIN, Junjing ZHU, Lin CHEN. Metric-based learning approach to botnet detection with small samples[J]. Chinese Journal of Network and Information Security, 2023, 9(5): 33-47.
林宏刚, 朱竣菁, 陈麟. 小样本下基于度量学习的僵尸网络检测方法[J]. 网络与信息安全学报, 2023,9(5):33-47. DOI： 10.11959/j.issn.2096-109x.2023076.

Honggang LIN, Junjing ZHU, Lin CHEN. Metric-based learning approach to botnet detection with small samples[J]. Chinese Journal of Network and Information Security, 2023, 9(5): 33-47. DOI： 10.11959/j.issn.2096-109x.2023076.

摘要

僵尸网络给互联网带来了极大的威胁，尽早有效地检测出僵尸网络对于维护网络空间安全具有重要的实践意义。然而在僵尸网络发现初期，可获得带标记样本数量较少，这使得目前大部分基于深度学习的检测方法无法得到充分训练，导致检测结果不佳。因此，提出了一种用于小样本下的基于度量学习的僵尸网络检测方法 BT-RN，利用基于任务的元学习训练策略优化模型，在任务中引入验证集并通过度量验证样本和训练样本特征表示之间的相似度来快速累积经验，从而降低模型对标记样本空间的依赖；引入了特征级注意力机制，通过计算特征中各维度的注意力系数，重新整合特征表示并分配重要度关注来优化特征表示，从而减少深度神经网络在小样本中的特征稀疏问题；引入了残差网络设计模式，利用跳跃链接来规避增加特征级注意力机制模块后，较深的网络所带来的模型退化和梯度消失风险。实验结果表明，在小样本背景下，所提僵尸网络检测方法的正确率和模型泛化能力优于其他小样本检测方法和深度学习检测方法。

Abstract

Botnets pose a great threat to the Internet

and early detection is crucial for maintaining cybersecurity.However

in the early stages of botnet discovery

obtaining a small number of labeled samples restricts the training of current detection models based on deep learning

leading to poor detection results.To address this issue

a botnet detection method called BT-RN

based on metric learning

was proposed for small sample backgrounds.The task-based meta-learning training strategy was used to optimize the model.The verification set was introduced into the task and the similarity between the verification sample and the training sample feature representation was measured to quickly accumulate experience

thereby reducing the model’s dependence on the labeled sample space.The feature-level attention mechanism was introduced.By calculating the attention coefficients of each dimension in the feature

the feature representation was re-integrated and the importance attention was assigned to optimize the feature representation

thereby reducing the feature sparseness of the deep neural network in small samples.The residual network design pattern was introduced

and the skip link was used to avoid the risk of model degradation and gradient disappearance caused by the deeper network after increasing the feature-level attention mechanism module.

关键词

Keywords

references

国家计算机网络应急技术处理协调中心(CNCERT/CC) . CNCERT互联网安全威胁报告 [R ] . 2021 - 8 .

National Computer Network Emergency Response Technology Processing Coordination Center (CNCERT/CC) . CNCERT Internet security threat report [R ] . 2021 - 8 .

国家计算机网络应急技术处理协调中心(CNCERT/CC) . 2020 年中国互联网网络安全报告 [R ] . 2021 - 7 .

National Computer Network Emergency Response Technology Processing Coordination Center (CNCERT/CC) . 2020 China Internet network security report [R ] . 2021 - 7 .

XING Y , SHU H , ZHAO H , et al . Survey on botnet detection techniques:classification,methods,and evaluation [J ] . Mathematical Problems in Engineering , 2021 , 2021 : 1 - 24 .

GARG S , GUIZANI M , GUO S , et al . Guest editorial:special section on ai-driven developments in 5g-envisioned industrial automation:big data perspective [J ] . IEEE Transactions on Industrial Informatics , 2019 , PP ( 33 ): 1 .

WANG X , YANG Q , JIN X . Periodic communication detection algorithm of botnet based on quantum computing [J ] . Chinese Journal of Quantum Electronics , 2016 , 33 ( 2 ): 182 - 187 .

SPATHOULAS G , GIACHOUDIS N , DAMIRIS G-P , et al . Collaborative blockchain-based detection of distributed denial of service attacks based on internet of things botnets [J ] . Future Internet , 2019 , 11 ( 11 ): 226 .

LASHKARI A H , GIL G D , KEENAN J E , et al . A survey leading to a new evaluation framework for network-based botnet detection [C ] // International Conference . 2017 : 59 - 66 .

WANG J , CHEN Y . Botnet detection method based on permutation entropy and clustering variance [C ] // The 2017 3rd International Symposium on Mechatronics and Industrial Informatics(ISMII 2017) . 2017 : 161 - 166 .

BILGE L , BALZAROTTI D , ROBERTSON W , et al . Disclosure:detecting botnet command and control servers through large-scale NetFlow analysis [C ] // Proceedings of the 28th Annual Computer Security Applications Conference . 2012 : 129 - 138 .

金渝筌 , 谢彬 , 朱毅 . 基于通信相似度的僵尸网络节点检测方法 [J ] . 网络与信息安全学报 , 2018 , 4 ( 10 ): 31 - 38 .

JIN Y Q , XIE B , ZHU Y . Method of botnet network nodes detection base on communication similarity [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 10 ): 31 - 38 .

JUNG W , ZHAO H , SUN M , et al . IoT botnet detection via power consumption modeling [J ] . Smart Health , 2020 ,15:100103.

WANG W , ZHU M , ZENG X , et al . Malware traffic classification using convolutional neural network for representation learning [C ] // 2017 International Conference on Information Networking (ICOIN) . 2017 : 712 - 717 .

尹传龙 , 祝跃飞 , 张鹤童 . 基于LSTM深度学习的僵尸网络检测模型 [J ] . 信息工程大学学报 , 2018 , 19 ( 94 ): 76 - 82 .

YIN C L , ZHU Y F , ZHANG H T . Deep learning approach for botnet detection using LSTM [J ] . Journal of Information Engineering University , 2018 , 19 ( 94 ): 76 - 82 .

罗扶华 , 张爱新 . 基于深度学习的僵尸网络检测技术研究 [J ] . 通信技术 , 2020 , 53 ( 1 ): 174 - 179 .

LUO F H , ZHANG A X . Botnet detection technology based on deep learning [J ] . Communications Technology , 2020 , 53 ( 1 ): 174 - 179 .

谭越 , 邹福泰 . 基于ResNet和BiLSTM的僵尸网络检测方法 [J ] . 通信技术 , 2019 , 52 ( 12 ): 7 .

TAN Y , ZOU F T . Botnet detection method based on BiLSTM and ResNet [J ] . Communications Technology , 2019 , 52 ( 12 ): 7 .

YERIMA S Y , ALZAYLAEE M K , SHAJAN A . Deep learning techniques for android botnet detection [J ] . Electronics , 2021 , 10 ( 4 ): 519 .

OLASEHINDE O , JOHNSON O V , CATHERINE O O . Evaluation of selected meta learning algorithms for the prediction improvement of network intrusion detection system [C ] // 2020 International Conference in Mathematics,Computer Engineering and Computer Science (ICMCECS) . 2020 .

XU C , SHEN J , DU X . A method of few-shot network intrusion detection based on meta-learning framework [J ] . IEEE Transactions on Information Forensics and Security , 2020 ( 99 ): 1 .

TANG Z , WANG P , WANG J . ConvProtoNet:deep prototype induction towards better class representation for few-shot malware classification [J ] . Applied Sciences , 2020 , 10 ( 8 ): 2847 .

PAN J . Iot network behavioral fingerprint inference with limited network traces for cyber investigation [C ] // 2021 International Conference on Artificial Intelligence in Information and Communication (ICAIIC) . 2021 : 263 - 268 .

HINDY H , TACHTATZIS C , ATKINSON R , et al . Developing a siamese network for intrusion detection systems [C ] // Proceedings of the 1st Workshop on Machine Learning and Systems . 2021 : 120 - 126 .

TIANYU G , ZHIYUAN L , MAOSONG S , et al . Hybrid attention-based prototypical networks for noisy few-shot relation classification [C ] // The AAAI Conference on Artificial Intelligence , 2019 : 6407 - 6414 .

AMIR E , DAVID E , MASSOUD P , et al . A meta-learning approach for custom model training [C ] // The AAAI Conference on Artificial Intelligence . 2019 : 9937 - 9938 .

YANG A , LU C , LI J , et al . Application of meta-learning in cyberspace security:a survey [J ] . Digital Communications and Networks , 2022 , 9 ( 1 ): 67 - 78 .

HOSPEDALES T M , ANTONIOU A , MICAELLI P , et al . Meta-learning in neural networks:a survey [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2021 , 44 ( 9 ): 5149 - 5169 .

WOO S , PARK J , LEE J Y , et al . Cbam:convolutional block attention module [C ] // Proceedings of the European Conference on Computer vision (ECCV) . 2018 : 3 - 19 .

HE K , ZHANG X , REN S , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 770 - 778 .

SZEGEDY C , LIU W , JIA Y , et al . Going deeper with Convolutions [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2015 : 1 - 9 .

ZOU Y , ZHANG L , LIU C , et al . Super-resolution reconstruction of infrared images based on a convolutional neural network with skip connections [J ] . Optics and Lasers in Engineering , 2021 ,146:106717.

SUNG F , YANG Y , ZHANG L , et al . Learning to compare:Relation network for few-shot learning [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 1199 - 1208 .

VINYALS O , BLUNDELL C , LILLICRAP T , et al . Matching networks for one shot learning [J ] . Advances in Neural Information Processing Systems , 2016 : 3637 - 3645 .

SNELL J , SWERSKY K , ZEMEL R . Prototypical networks for few-shot learning [C ] // Proceedings of the 31st International Conference on Neural Information Processing Systems . 2017 : 4080 - 4090 .

DOSOVITSKIY A , BEYER L , KOLESNIKOV A , et al . An image is worth 16×16 words:transformers for image recognition at scale [C ] // International Conference on Learning Representations . 2021 .

DAI Z , LIU H , LE Q V , et al . CoAtNet:marrying convolution and attention for all data sizes [J ] . 2021:arXiv.2016.04803 .

HUISMAN M , VAN RIJN J N , PLAAT A . A survey of deep meta-learning [J ] . 2020:arXiv:2010.03522 .

浏览量

161

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

自监督学习驱动的注意力增强恶意流量检测方法

面向可扩展僵尸网络的安全控制方法

基于智能合约的高对抗性僵尸网络研究

基于通信相似度的僵尸网络节点检测方法

Mirai僵尸网络恶意程序分析和监测数据研究