DeepHTTP: Semantics-Structure Model with Attention for Anomalous HTTP Traffic Detection and Pattern Mining
Beihang University（北京航空航天大学）；National Computer Network Emergency Response Technical Team/Coordination Center of China（国家计算机网络应急技术处理协调中心）；Beijing University of Posts and Telecommunications（北京邮电大学）
In the Internet age, cyber-attacks occur frequently with complex types. Traffic generated by access activities can record website status and user request information, which brings a great opportunity for network attack detection. Among diverse network protocols, Hypertext Transfer Protocol (HTTP) is widely used in government, organizations and enterprises. In this work, we propose DeepHTTP, a semantics structure integration model utilizing Bidirectional Long Short-Term Memory (Bi-LSTM) with attention mechanism to model HTTP traffic as a natural language sequence. In addition to extracting traffic content information, we integrate structural information to enhance the generalization capabilities of the model. Moreover, the application of attention mechanism can assist in discovering critical parts of anomalous traffic and further mining attack patterns. Additionally, we demonstrate how to incrementally update the data set and retrain model so that it can be adapted to new anomalous traffic. Extensive experimental evaluations over large traffic data have illustrated that DeepHTTP has outstanding performance in traffic detection and pattern discovery.
Traffic Flow Forecasting with Spatial-Temporal Graph Diffusion Network
South China University of Technology（华南理工大学）；JD Finance America Corporation（京东金融美国公司）；Communication and Computer Network Laboratory of Guangdong（广东省通信与计算机网络实验室）；Peng Cheng Laboratory（鹏城实验室）；JD Intelligent Cities Research（京东智能城市研究院）；JD Intelligent Cities Business Unit, JD Digits（京东数字科技智能城市业务部）
Few-Shot Network Intrusion Detection Using Online Triplet Mining
Department of Electronics and Electrical Engineering, University of Strathclyde（斯特拉斯克莱德大学电子与电气工程系）；Faculty of Computer and Information Sciences, Ain Shams University（爱思曼大学计算机与信息科学学院）；Faculty of Electrical Engineering, Czech Technical University（捷克技术大学电气工程学院）
Anomaly Detection Framework Using Rule Extraction for Efficient Intrusion Detection
University of Jyväskylä（于韦斯屈莱大学）
网络安全中的庞大数据集，如网络流量日志，可以使用机器学习和数据采掘方法进行分析。然而，收集的数据量正在增加，这使得分析更加困难。许多机器学习方法不是为大数据集设计的，因此速度慢且难以理解。我们通过创建一个应用降维和合取规则提取的入侵检测框架来解决有效的网络流量分类问题。该系统可以执行无监督的异常检测，并使用此信息创建合取规则，对大量流量进行实时的分类。我们使用广泛使用的KDD Cup 99数据集和真实世界的网络日志对实现的系统进行了测试，以确认性能令人满意。这个系统是透明的，不像一个黑盒子，使它直观的领域专家，如网络管理员。
