To address the problem that traditional network traffic anomaly detection algorithms do not suffi-ciently mine potential features in long time domain, an anomaly detection method based on mul-ti-scale residual features of network traffic is proposed. The original traffic is divided into subse-quences of different time spans using sliding windows, and each subsequence is decomposed and reconstructed into data sequences of different levels using wavelet transform technique; the stacked autoencoder (SAE) constructs similar feature space using normal network traffic, and gen-erates reconstructed error vector using the difference between reconstructed samples and input samples in the similar feature space; the multi-path residual group is used to learn reconstructed error The traffic classification is completed by a lightweight classifier. The experimental results show that the detection performance of the proposed method for anomalous network traffic is sig-nificantly improved compared with traditional methods; it confirms that the longer time span and more S transformation scales have positive effects on discovering potential diversity information in the original network traffic.
翻译:为解决传统网络交通异常现象探测算法在长时期内不会扼杀潜在矿藏特征的问题,提议了一种基于网络交通中多尺度残留特征的异常现象探测方法。最初的交通用滑动窗口分为不同时间段的子量,每个子序列使用波盘变换技术分解并重建为不同层次的数据序列;堆叠自动编码器(SAE)使用正常网络流量建造类似的地貌空间,利用类似地貌空间中经过重建的样品和输入样品之间的差别重建出错矢量;多路径残余组用于学习重新发现的错误。交通分类由一个轻量分类器完成。实验结果表明,与传统方法相比,拟议的反声波网络交通方法的探测性能已大大改善;它证实,较长的时间间隔和更多的变异尺度对发现原始网络流量中的潜在多样性信息产生了积极影响。