Computer Engineering and Applications ›› 2022, Vol. 58 ›› Issue (14): 89-95.DOI: 10.3778/j.issn.1002-8331.2104-0159

• Network, Communication and Security • Previous Articles     Next Articles

Malicious Traffic Detection Method Based on Siamese Neural Network

LI Daoquan, LU Xiaofu, YANG Qianqian   

  1. School of Information and Control Engineering, Qingdao University of Technology, Qingdao, Shandong 266525, China
  • Online:2022-07-15 Published:2022-07-15

基于孪生神经网络的恶意流量检测方法

李道全,鲁晓夫,杨乾乾   

  1. 青岛理工大学 信息与控制工程学院,山东 青岛 266525

Abstract: With the development of technology, PC and cell phones have become indispensable smart devices in modern society. A large number of applications in PC and cell phones provide users with convenient web services such as live chat, email, and downloads, etc. via the Internet. However, the popularity of these devices has also attracted a large number of malicious attackers, and malicious applications and malicious traffic have arisen as a result. To address this problem, this paper proposes an end-to-end single-sample detection method based on Siamese neural network on the basis of malicious traffic classification detection. First, the sample data is pre-processed into grayscale images, then the image samples are trained and learned in the TensorFlow deep learning framework, and finally the detection of malicious traffic is achieved by comparing the similarity between grayscale images. The method proposed in this paper can not only realize end-to-end single-sample detection, but also provides a solution to the classification problem of imbalanced dataset. The final experimental detection accuracy rate can reach 95.04%, which proves the feasibility and scientific validity of this method.

Key words: malicious traffic, Siamese neural network, grayscale image, similarity, single sample, sample imbalance

摘要: 随着科技的发展,个人电脑和手机成为现代社会中所不可缺少的智能设备。个人电脑和手机中丰富的应用程序通过互联网给用户提供诸如实时聊天、邮件、下载等便捷的网络服务。但是,这些设备的普及也吸引了大量的恶意攻击者,恶意应用程序和恶意流量随之产生。针对这一问题,在恶意流量分类检测的基础上,基于孪生神经网络提出一种端到端的单样本检测方法。对样本数据进行预处理转化为灰度图像,在TensorFlow深度学习框架下对图像样本进行训练学习,通过对比灰度图像间的相似程度实现了恶意流量的检测。提出的方法不仅能够实现端到端的单样本检测,而且在样本不均衡的分类问题上也给出了一种解决方案。最终的实验检测准确率可达95.04%,证明了该方法的可行性和科学性。

关键词: 恶意流量, 孪生神经网络, 灰度图像, 相似程度, 单样本, 样本不均衡