利用流聚合对良性模仿攻击进行分类
Utilising Flow Aggregation to Classify Benign Imitating Attacks
摘要：
网络攻击在数量和复杂性方面都在继续增长。这得益于可用计算能力的增加、攻击面的扩大以及人类对如何使攻击无法检测的理解的进步。毫不奇怪，机器学习被用来抵御这些攻击。在许多应用中，特征的选择比模型的选择更重要。一系列研究试图区分良性流量和众所周知的网络攻击，并取得了不同程度的成功。这些研究中使用的功能大致相似，并已证明在网络攻击不模仿良性行为的情况下有效。为了克服这一障碍，在本文中，我们引入了基于更高层次的网络流量抽象的新功能。具体来说，我们通过对具有相似性的流进行分组来执行流聚合。这种额外的特征抽象级别受益于累积信息，从而使模型能够对模仿良性流量的网络攻击进行分类。使用基准CICIDS2017数据集对新特征的性能进行了评估，结果证明了它们的有效性和有效性。这一新的方案将提高网络攻击的检测精度，也朝着复杂网络攻击的特征提取的新方向发展。
英文摘要：
Cyber-attacks continue to grow, both in terms of volume and sophistication. This is aided by an increase in available computational power, expanding attack surfaces, and advancements in the human understanding of how to make attacks undetectable. Unsurprisingly, machine learning is utilised to defend against these attacks. In many applications, the choice of features is more important than the choice of model. A range of studies have, with varying degrees of success, attempted to discriminate between benign traffic and well-known cyber-attacks. The features used in these studies are broadly similar and have demonstrated their effectiveness in situations where cyber-attacks do not imitate benign behaviour. To overcome this barrier, in this manuscript, we introduce new features based on a higher level of abstraction of network traffic. Specifically, we perform flow aggregation by grouping flows with similarities. This additional level of feature abstraction benefits from cumulative information, thus qualifying the models to classify cyber-attacks that mimic benign traffic. The performance of the new features is evaluated using the benchmark CICIDS2017 dataset, and the results demonstrate their validity and effectiveness. This novel proposal will improve the detection accuracy of cyber-attacks and also build towards a new direction of feature extraction for complex ones.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
