In the field of abnormal network traffic detection, traditional deep learning-based methods have not separately considered the role of port numbers in network traffic. In order to enhance the efficiency of abnormal network traffic detection, a network traffic anomaly detection model combining attention mechanism is proposed, which includes Port Attention Mechanism (PAM) and ResNET-BiLSTM-RF. Firstly, the original network traffic is input into the port attention module to separate the port number attribute. The weight values of port attention are then utilized to filter out other important features, outputting the traffic attributes of port attention. Subsequently, the other traffic attributes are input into the deep learning network model of ResNET- BiLSTM-RF. In the first stage, a residual network (ResNET) is employed for binary classification to distinguish benign traffic from attack traffic. In the second stage, attack traffic is input into BiLSTM and random forest for multi-class decision making. This model has been experimentally validated to achieve high accuracy on the CICIDS-2017 data set.
Network Traffic Anomaly Detection Based on Port Attention Mechanism and ResNET-BiLSTM-RF
07.06.2024
6029536 byte
Aufsatz (Konferenz)
Elektronische Ressource
Englisch
Road traffic flow detection equipment based on ResNet-50 convolutional neural network
Europäisches Patentamt | 2025
|