Abstract: Aiming at the low accuracy, insufficient feature extraction, and model overfitting problems of the current malicious traffic detection method under small samples, a malicious traffic detection algorithm based on an improved decision tree-siamese neural network（SNN） under small samples is proposed. To reduce the difficulty of multi-classification tasks under small samples, a binary decision tree is constructed using the center distance between classes to convert multi-class problems into binary classification problems. The comparative branch of SNN is designed as a parallel structure of three one-dimensional convolutional neural networks to solve the problem of insufficient feature extraction under small samples. The squeeze-and-excitation module optimized by pooling strategies and one-dimensional convolution operations is introduced to reduce the problem of model overfitting under small samples. Malicious traffic detection is achieved by comparing the similarity of samples. The experimental results show that the proposed method effectively detects malicious traffic under small samples.

Key words: malicious traffic, decision tree, siamese neural network（SNN）, center distance between classes, small sample, channel attention

摘要： 针对目前小样本下的恶意流量检测方法存在准确度低、特征提取不足和模型过拟合问题，提出了一种小样本下基于改进决策树-孪生神经网络的恶意流量检测算法。为了降低小样本下多分类任务的难度，利用类间中心距离构建二叉决策树将多分类问题转换为二分类问题。将孪生神经网络的对比分支设计为三支一维卷积神经网络并行的结构来解决小样本下特征提取不足问题。引入了通过池化策略和一维卷积操作优化的SE（squeeze-and-excitation）模块，以减少小样本下模型过拟合问题。通过对比样本的相似度实现了恶意流量检测。实验结果表明，所提方法在小样本下的恶意流量检测问题上具有良好的效果。

关键词: 恶意流量, 决策树, 孪生神经网络, 类间中心距离, 小样本, 通道注意力