融合一维Inception结构与ViT的恶意加密流量检测

doi:10.19678/j.issn.1000-3428.0064785

摘要/Abstract

摘要： 在互联网加密化背景下，传统恶意流量检测方法在加密流量上的特征区分度较差，为更好地从加密流量中检测出恶意流量，设计一个融合一维Inception-ViT的恶意加密流量检测模型。基于流量数据的时序性特点，通过一维Inception结构对GoogLeNet中的Inception结构进行改进，使用适用于序列数据的一维卷积替换二维卷积，并添加池化操作去除一些冗余信息的干扰。同时，融合ViT模型，将经过一维Inception结构处理后的数据输入到ViT模型中，利用多头注意力突出重要特征，增强特征区分度以提升模型检测结果。为验证一维Inception-ViT模型各模块的有效性，与6种变体模型进行对比，实验结果表明，一维Inception-ViT模型性能最好，平均召回率和平均F1值指标分别达到了99.42%和99.39%。此外，与其他8种现有模型进行比较，一维Inception-ViT模型具有更好的检测效果，同时在恶意加密流量Neris和Virut细粒度分类上，与性能最好的基准模型相比，一维Inception-ViT模型能够有效减少样本检测混淆，可更准确地对恶意加密流量进行识别。

关键词: 加密流量, 恶意加密流量检测, 多分类, 卷积神经网络, Vision Transformer模型

Abstract: In Internet encryption, traditional malicious traffic detection performs poorly in distinguishing encrypted traffic.To detect malicious traffic in encrypted traffic better, this paper designs a malicious encryption traffic detection model integrating a one-dimensional Inception structure and Vision Transformer(ViT).Based on the timing characteristics of traffic data, the one-dimensional Inception structure improves the Inception structure in GoogLeNet, replaces two-dimensional convolution with one-dimensional convolution, which is more suitable for sequence data, and adds a pooling operation to remove the interference of some redundant information.At the same time, the ViT model is fused.After being processed by the one-dimensional Inception structure, the data are input into the ViT model.Multi-head attention is used to highlight important features and further enhance feature differentiation to improve the model detection results.To verify the effectiveness of each module of the one-dimensional Inception ViT model, six variant models are generated for comparison.The experimental results show that the performance of the one-dimensional Inception ViT model is the best, reaching 99.42% and 99.39% for average recall and average F1 value, respectively.In addition, in a comparison with eight other models, the one-dimensional Inception ViT model has better detection.In the fine-grained classification of malicious encrypted traffic Neris and Virut, compared with the best-performing baseline model, the one-dimensional Inception ViT model reduces the sample detection confusion, indicating that it can identify malicious encrypted traffic more accurately.

Key words: encryptied traffic, malicious encryptioed traffic detection, multi-classification, Convolutional Neural Network(CNN), Vision Transformer(ViT) model

中图分类号:

TP309

孙懿, 高见, 顾益军. 融合一维Inception结构与ViT的恶意加密流量检测[J]. 计算机工程, 2023, 49(1): 154-162.

SUN Yi, GAO Jian, GU Yijun. Malicious Encrypted Traffic Detection Integrating One-Dimensional Inception Structure and ViT[J]. Computer Engineering, 2023, 49(1): 154-162.

https://www.ecice06.com/CN/Y2023/V49/I1/154

图/表 15

20230701175817

20230701175821

20230701175824

20230701175827

20230701175830

20230701175834

20230701175838

20230701175841

20230701175844

20230701175849

20230701175852

20230701175856

20230701175900

20230701175903

20230701175906

参考文献

[1] 张稣荣, 卜佑军, 陈博, 等.基于多层双向SRU与注意力模型的加密流量分类方法[J/OL].计算机工程:1-15[2022-02-25].http://doi.org/10.19678/j.issn.1000-3428.0063626. ZHANG S R, BU Y J, CHEN B, et al.Encryption traffic classification based on multi-layer bidirectional SRU and attention model[J/OL].Computer Engineering:1-15[2022-02-25].http://doi.org/10.19678/j.issn.1000-3428.0063626. (in Chinese)
[2] MEEKER M.Internet trends online[EB/OL].[2022-04-20].https://www.bondcap.com/report/itr19/.
[3] 薛文龙, 于炯, 郭志琦, 等.基于特征融合卷积神经网络的端到端加密流量分类[J].计算机工程与应用, 2021, 57(18):114-121. XUE W L, YU J, GUO Z Q, et al.End-to-end encrypted traffic classification based on feature fusion convolutional neural network[J].Computer Engineering and Applications, 2021, 57(18):114-121.(in Chinese)
[4] REZAEI S, LIU X.Deep learning for encrypted traffic classification:an overview[J].IEEE Communications Magazine, 2019, 57(5):76-81.
[5] MADHUKAR A, WILLIAMSON C.A longitudinal study of P2P traffic classification[C]//Proceedings of the 14th IEEE International Symposium on Modeling, Analysis, and Simulation.Washington D.C., USA:IEEE Press, 2006:179-188.
[6] THAY C, VISOOTTIVISETH V, MONGKOLLUKSAMEE S.P2P traffic classification for residential network[C]//Proceedings of International Computer Science and Engineering Conference.Washington D.C., USA:IEEE Press, 2016:1-6.
[7] MOORE A W, PAPAGIANNAKI K.Toward the accurate identification of network applications[C]//Proceedings of 2005 International Workshop on Passive and Active Network.Berlin, Germany:Springer, 2005:41-54.
[8] 王伟.基于深度学习的网络流量分类及异常检测方法研究[D].合肥:中国科学技术大学, 2018. WANG W.Deep learning for network traffic classification and anomaly detection[D].Hefei:University of Science and Technology of China, 2018.(in Chinese)
[9] WANG W, ZHU M, WANG J L, et al.End-to-end encrypted traffic classification with one-dimensional convolution neural networks[C]//Proceedings of 2017 IEEE International Conference on Intelligence and Security Informatics.Washington D.C., USA:IEEE Press, 2017:43-48.
[10] WANG W, ZHU M, ZENG X W, et al.Malware traffic classification using convolutional neural network for representation learning[C]//Proceedings of 2017 International Conference on Information Networking.Washington D.C., USA:IEEE Press, 2017:712-717.
[11] 梁杰, 陈嘉豪, 张雪芹, 等.基于独热编码和卷积神经网络的异常检测[J].清华大学学报(自然科学版), 2019, 59(7):523-529. LIANG J, CHEN J H, ZHANG X Q, et al.One-hot encoding and convolutional neural network based anomaly detection[J].Journal of Tsinghua University (Science and Technology), 2019, 59(7):523-529.(in Chinese)
[12] SZEGEDY C, LIU W, JIA Y Q, et al.Going deeper with convolutions[C]//Proceedings of 2015 IEEE Conference on Computer Vision and Pattern Recognition.Boston, USA:IEEE Computer Society, 2015:1-9.
[13] LECUN Y, BOTTOU L, BENGIO Y, et al.Gradient-based learning applied to document recognition[J].Proceedings of the IEEE, 1998, 86(11):2278-2324.
[14] 叶晓舟, 王伟, 曾学文.一种基于两阶段序列特征学习的网络流量分类方法及系统:CN108199863A[P].2018-06-22. YE X Z, WANG W, ZENG X W.Network traffic classification method and system based on two-phase sequence feature learning:CN108199863A[P].2018-06-22.(in Chinese)
[15] ZOU Z, GE J G, ZHENG H B, et al.Encrypted traffic classification with a convolutional long short-term memory neural network[C]//Proceedings of the 20th IEEE International Conference on High Performance Computing and Communication.Washington D.C., USA:IEEE Press, 2018:329-334.
[16] 刘冲.基于深度学习的流量分类系统[D].北京:北京邮电大学, 2019. LIU C.Traffic classification system based on deep learning[D].Beijing:Beijing University of Posts and Telecommunications, 2019.(in Chinese)
[17] DOSOVITSKIY A, BEYER L, KOLESNIKOV A, et al.An image is worth 16x16 words:transformers for image recognition at scale[EB/OL].[2022-04-20].https://arxiv.org/abs/2010.11929.
[18] DAINOTTI A, PESCAPE A, CLAFFY K C.Issues and future directions in traffic classification[J].IEEE Network, 2012, 26(1):35-40.
[19] NETRESE C.SplitCap[EB/OL].[2022-04-20].https://www.netresrc.com/?page=SplitCap.
[20] 杨彦召, 朱程威, 仇晶, 等.基于TextCNN的加密恶意流量检测方法[J].广州大学学报(自然科学版), 2022, 21(1):1-9. YANG Y Z, ZHU C W, QIU J, et al.Encrypted malicious traffic detection method based on TextCNN[J].Journal of Guangzhou University (Natural Science Edition), 2022, 21(1):1-9.(in Chinese)
[21] 张显杰, 张之明.基于卷积神经网络和Transformer的手写体英文文本识别[J].计算机应用, 2022, 42(8):2394-2400. ZHANG X J, ZHANG Z M.Handwritten English text recognition based on convolutional neural network and Transformer[J].Journal of Computer Applications, 2022, 42(8):2394-2400.(in Chinese)
[22] 李道全, 王雪, 于波, 等.基于一维卷积神经网络的网络流量分类方法[J].计算机工程与应用, 2020, 56(3):94-99. LI D Q, WANG X, YU B, et al.Network traffic classification method based on one-dimensional convolution neural network[J].Computer Engineering and Applications, 2020, 56(3):94-99.(in Chinese)
[23] VASWANI A, SHAZEER N, PARMAR N, et al.Attention is all you need[C]//Proceedings of the 31st International Conference on Neural Information Processing Systems.Cambridge, USA:MIT Press 2017:6000-6010.
[24] 蒋彤彤, 尹魏昕, 蔡冰, 等.基于层次时空特征与多头注意力的恶意加密流量识别[J].计算机工程, 2021, 47(7):101-108. JIANG T T, YIN W X, CAI B, et al.Encrypted malicious traffic identification based on hierarchical spatiotemporal feature and multi-head attention[J].Computer Engineering, 2021, 47(7):101-108.(in Chinese)
[25] HE K M, ZHANG X Y, REN S Q, et al.Deep residual learning for image recognition[C]//Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2016:770-778.

选择文件类型/文献管理软件名称

选择包含的内容