arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2403.10550cs.LGcs.AIcs.CR
收藏

基于双向归一化流的异常流量检测半监督学习

Semi-Supervised Learning for Anomaly Traffic Detection via Bidirectional Normalizing Flows

Xidian University(西安电子科技大学);Amazon(亚马逊);Chongqing University of Posts and Telecommunications(重庆邮电大学)

Zhangxuan Dang, Yu Zheng, Xinglin Lin, Chunlei Peng, Qiuyu Chen, Xinbo Gao

AI总结:

提出仅用正常流量训练的三阶段异常检测框架,通过双向流生成伪异常样本,在基准数据集上达到最先进性能。

摘要:

随着互联网的快速发展,各种类型的异常流量正威胁着网络安全。我们考虑了异常网络流量检测的问题,并提出了一种仅使用正常流量的三阶段异常检测框架。我们的框架可以在不了解异常先验知识的情况下生成伪异常样本,以实现对异常数据的检测。首先,我们采用重建方法来学习正常样本的深度表示。其次,这些表示通过双向流模块被归一化为标准正态分布。为了模拟异常样本,我们对归一化后的表示添加噪声,然后将其通过双向流模块的生成方向。最后,训练一个简单的分类器,以在潜在空间中区分正常样本和伪异常样本。在推理过程中,我们的框架仅需要两个模块即可检测异常样本,从而显著减小了模型规模。根据实验,我们的方法在异常网络流量检测的常见基准数据集上达到了最先进的结果。代码可在 https://github.com/ZxuanDang/ATD-via-Flows.git 获取。

英文摘要:

With the rapid development of the Internet, various types of anomaly traffic are threatening network security. We consider the problem of anomaly network traffic detection and propose a three-stage anomaly detection framework using only normal traffic. Our framework can generate pseudo anomaly samples without prior knowledge of anomalies to achieve the detection of anomaly data. Firstly, we employ a reconstruction method to learn the deep representation of normal samples. Secondly, these representations are normalized to a standard normal distribution using a bidirectional flow module. To simulate anomaly samples, we add noises to the normalized representations which are then passed through the generation direction of the bidirectional flow module. Finally, a simple classifier is trained to differentiate the normal samples and pseudo anomaly samples in the latent space. During inference, our framework requires only two modules to detect anomalous samples, leading to a considerable reduction in model size. According to the experiments, our method achieves the state of-the-art results on the common benchmarking datasets of anomaly network traffic detection. The code is given in the https://github.com/ZxuanDang/ATD-via-Flows.git

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑