In the field of abnormal network traffic detection, traditional deep learning-based methods have not separately considered the role of port numbers in network traffic. In order to enhance the efficiency of abnormal network traffic detection, a network traffic anomaly detection model combining attention mechanism is proposed, which includes Port Attention Mechanism (PAM) and ResNET-BiLSTM-RF. Firstly, the original network traffic is input into the port attention module to separate the port number attribute. The weight values of port attention are then utilized to filter out other important features, outputting the traffic attributes of port attention. Subsequently, the other traffic attributes are input into the deep learning network model of ResNET- BiLSTM-RF. In the first stage, a residual network (ResNET) is employed for binary classification to distinguish benign traffic from attack traffic. In the second stage, attack traffic is input into BiLSTM and random forest for multi-class decision making. This model has been experimentally validated to achieve high accuracy on the CICIDS-2017 data set.
Network Traffic Anomaly Detection Based on Port Attention Mechanism and ResNET-BiLSTM-RF
2024-06-07
6029536 byte
Conference paper
Electronic Resource
English
Road traffic flow detection equipment based on ResNet-50 convolutional neural network
European Patent Office | 2025
|