基于改进的残差U-Net的不平衡协议识别方法

吴吉胜; 洪征; 马甜甜

doi:10.11959/j.issn.2096-109x.2024004

您当前的位置：

首页 >

文章列表页 >

基于改进的残差U-Net的不平衡协议识别方法

学术论文 | 更新时间：2024-06-03

- 基于改进的残差U-Net的不平衡协议识别方法
- Unbalanced protocol recognition method based on improved residual U-Net
- 网络与信息安全学报 2024年10卷第1期页码：136-155
- 作者机构：
- 作者简介：
  
  [ "吴吉胜（1997− ），男，湖南凤凰人，陆军工程大学硕士生，主要研究方向为协议识别" ]
  [ "洪征（1979− ），男，江西南昌人，陆军工程大学副教授，主要研究方向为漏洞挖掘和协议逆向分析" ]
  [ "马甜甜（1998− ），女，江苏邳州人，陆军工程大学硕士生，主要研究方向为信息安全" ]
- 基金信息：
  
  国家重点研发计划基金资助项目;The Natural Science Foundation of Jiangsu Province(2017YFB0802900)
- DOI：10.11959/j.issn.2096-109x.2024004
  中图分类号： TP398.08
- 网络首发：2024-02，
  
  纸质出版：2024-02-25
- 稿件说明：
移动端阅览
吴吉胜, 洪征, 马甜甜. 基于改进的残差U-Net的不平衡协议识别方法[J]. 网络与信息安全学报, 2024,10(1):136-155.

Jisheng WU, Zheng HONG, Tiantian MA. Unbalanced protocol recognition method based on improved residual U-Net[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 136-155.
吴吉胜, 洪征, 马甜甜. 基于改进的残差U-Net的不平衡协议识别方法[J]. 网络与信息安全学报, 2024,10(1):136-155. DOI： 10.11959/j.issn.2096-109x.2024004.

Jisheng WU, Zheng HONG, Tiantian MA. Unbalanced protocol recognition method based on improved residual U-Net[J]. Chinese Journal of Network and Information Security, 2024, 10(1): 136-155. DOI： 10.11959/j.issn.2096-109x.2024004.

摘要

随着互联网的不断发展，网络攻击事件不断增多，成为网络安全的巨大挑战。在所捕获网络流量中，恶意流量往往占比较少，即攻击者使用的通信协议往往为少数类协议。当协议数据的类别分布不平衡时，现有协议识别方法能够识别出多数类协议，但是难以准确识别少数类协议。针对这一问题，提出一种基于改进的残差 U-Net 的不平衡协议识别方法，利用新的激活函数和 SE-Net（squeeze-and-excitation networks）改进残差U-Net，提升残差U-Net的特征提取能力。同时采用带权重的Dice损失函数作为协议识别模型的损失函数，少数类协议的识别准确率偏低会导致损失函数的值偏高，进而促使少数类协议主导模型的优化方向。采用所提方法进行协议识别时，首先从网络流量中抽取网络流，经过预处理转化为一维矩阵，利用协议识别模型提取协议数据的特征，进而由Softmax分类器计算输出协议类型。实验结果表明，与对比模型相比，所提协议识别模型能够更为准确地识别少数类协议，同时多数类协议的识别准确率得到了提升。

Abstract

An unbalanced protocol recognition method based on the improved Residual U-Net was proposed to solve the challenge of network security posed by the increasing network attacks with the continuous development of the Internet.In the captured network traffic

a small proportion is constituted by malicious traffic

typically utilizing minority protocols.However

existing protocol recognition methods struggle to accurately identify these minority protocols when the class distribution of the protocol data is imbalanced.To address this issue

an unbalanced protocol recognition method was proposed

which utilized the improved Residual U-Net

incorporating a novel activation function and the Squeeze-and-Excitation Networks (SE-Net) to enhance the feature extraction capability.The loss function employed in the proposed model was the weighted Dice loss function.In cases where the recognition accuracies of the minority protocols were low

the loss function value would be high.Consequently

the optimization direction of the model would be dominated by the minority protocols

resulting in improved recognition accuracies for them.During the protocol recognition process

the network flow was extracted from the network traffic and preprocessed to convert it into a one-dimensional matrix.Subsequently

the protocol recognition model extracted the features of the protocol data

and the Softmax classifier predicted the protocol types.Experimental results demonstrate that the proposed protocol recognition model achieves more accurate recognition of the minority protocols compared to the comparison model

while also improving the recognition accuracies of the majority protocols.

关键词

Keywords

references

FENG W B , HONG Z , WU L F , et al . Review of network protocol recognition techniques [J ] . Journal of Computer Applications , 2019 , 39 ( 12 ): 3604 - 3614 .

ZHANG Z X , LIU Q J , WANG Y H . Road extraction by deep residual U-Net [J ] . IEEE Geoscience and Remote Sensing Letters , 2018 , 15 ( 5 ): 749 - 753 .

HU J , SHEN L , SUN G . Squeeze-and-Excitation Networks [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 7132 - 7141 .

MILLETARI F , NAVAB N , AHMADI S H . V-Net:fully convolutional neural networks for volumetric medical image segmentation [C ] // 2016 fourth International Conference on 3D Vision(3DV) . 2016 : 565 - 571 .

WANG P , LI S H , YE F , et al . PacketCGAN:exploratory study of class imbalance for encrypted traffic classification using CGAN [C ] // Proceedings of 2020 IEEE International Conference on Communications (ICC) . 2020 : 222 - 224 .

HASIBI R , SHOKRI M , DEHGHAN M . Augmentation scheme for dealing with imbalanced network traffic classification using deep learning [J ] . arXiv preprint:1901.00204 , 2019 .

TANG H , LIU D , YAO L S , et al . Feature selection algorithm for class imbalanced internet traffic [J ] . Journal of Electronics ＆ Information Technology , 2021 , 43 ( 4 ): 923 - 930 .

GUPTA N , JINDAL V , BEDI P . CSE-IDS:using cost-sensitive deep learning and ensemble algorithms to handle class imbalance in network-based intrusion detection systems [J ] . Computers ＆ Security , 2022 ,( 112 ): 102499 .

TELIKANI A , GANDOMI A H , CHOO K K R , et al . A cost-sensitive deep learning based approach for network traffic classification [J ] . IEEE Transactions on Network and Service Management , 2022 , 19 ( 1 ): 661 - 670 .

ZHANG Y , CHEN X , GUO D , et al . PCCN:parallel cross convolutional neural network for abnormal network traffic flows detection in multi-class imbalanced network traffic Flows [J ] . IEEE Access , 2019 ( 7 ): 119904 - 119916 .

XIA B H , HAN D Z , YIN X M , et al . RICNN:a ResNet＆Inception convolutional neural network for intrusion detection of abnormal traffic [J ] . Computer Science and Information Systems , 2022 , 19 ( 1 ): 309 - 326 .

RONNEBERGER O , FISCHER P , BROX T . U-Net:convolutional networks for biomedical image segmentation [C ] // 18th International Conference on Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015 . 2015 : 234 - 241 .

HOWARD A , SANDLER M , CHEN B , et al . Searching for mobileNetV3 [J ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . 2019 : 1314 - 1324 .

LIN M , CHEN Q , YAN S C . Network in network [J ] . arXiv preprint:1312.4400 , 2014 .

SHIRAVI A , SHIRAVI H , TAVALLAEE M . Toward developing a systematic approach to generate benchmark datasets for intrusion detection [J ] . Computers ＆ Security , 2012 , 31 ( 3 ): 357 - 374 .

MOUSTAFA N , SLAY J . UNSW-NB15:a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set) [C ] // Proceedings of 2015 Military Communications and Information Systems Conference (MilCIS) . 2015 : 1 - 6 .

浏览量

105

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

面向图像识别的卷积神经网络鲁棒性研究进展

基于软件定义的可重构卷积神经网络架构设计

基于卷积神经网络恶意安卓应用行为模式挖掘

基于卷积神经网络的多尺度Logo检测算法

基于线性脉动阵列的卷积神经网络计算优化与性能分析