一种基于自蒸馏的自适应恶意流量分类算法

一种基于自蒸馏的自适应恶意流量分类算法流量的增长给网络安全监测和攻击防御带来了挑战，网络需要开发新的分类方法和技术来应对。本论文介绍了一种基于自适应恶意流量分类算法，该算法使用深度神经网络和自蒸馏和分类恶意流量。我们在常见的数据集上进行了实验验证，结AbstractTheproliferationofmaliciousnetworktraffichasposedchallengesfornetworksecuritymonitoringandattackdefense,andcybersecurityexpertsneedtodevelopnewclassificationmethodsandtechniquestocombatitThispaperintroducesaself-distillation-basedadaptivemalicioustrafficclassificationalgorithmthatusesdeepneuralnetworksandselfdistillationmechanismtoidentifyandclassifymalicioustraffic.Weconductedexperimentsoncommondatasets,andtheresultsshowthatthealgorithmachieveshighrecognitionandclassificationaccuracy.elfdistillationmalicioustrafficdeepneuralnetworksclassificationaccuracy.Withtheincreasingsophisticationofcyberthreats,traditionalrule-basedandsignaturebasedapproachesarenolongersufficienttoprotectnetworksfrommalicioustraffic.Malwareauthorsusesophisticatedevasiontechniquestoavoiddetectionandintrusionpreventionsystemshaveadifficulttimekeepingupwiththeadvancedtechniquestheyusetoinfectmachines.Asaresult,networksecurityexpertsmustturntomoreadvancedtechnologiestodetectandmitigaterisksposedbymalicioustraffic.hasemergedasapromisingtechnologyfordetectingandclassifyingmalicioustrafficinrecentyearsItiscapableofprocessinglargeamountsofunstructureddataandautomaticallylearningfrompatternsandfeaturesindataInaddition,deeplearningmodelscanadapttonewdatainputsovertimeandimprovetheiraccuracywithmoretrainingdataHoweverdeeplearningmodelsoftenrequirelargeamountsoflabeleddatatoachievehighaccuracy,whichisasignificantchallengeinthecontextofnetworktrafficclassificationduetothelackoflabeleddatafordifferenttypesofmalicioustraffic.Toaddressthischallenge,thispaperpresentsaself-distillation-basedadaptivemalicioustrafficclassificationalgorithmthatcanimprovetheaccuracyofdeepneuralnetworkswithlimitedlabeleddata.Specificallyweuseaself-distillationmechanismtotransferknowledgefromawelltrainedmodeltoasmallerandlesscomplexmodel,whichcanthenbeusedtoclassifymalicioustrafficwithlimitedlabeleddata.Severaltechniqueshavebeenproposedfortheclassificationofmalicioustraffic,includingmachinelearningmethodsandclusteringmethodsMachinelearningmethodsarebasedonmathematicalmodelsandlearnpatternsfromlabeleddata.Forexample,Zhangetal.[1]proposedamalwaredetectionapproachusingamulti-classsupportvectormachineChenetal.[2]proposedadeeplearningapproachformalwaredetectionusingconvolutionalneuralnetworks.Clusteringmethodsarebasedonthesimilarityofnetworktrafficflowsandaimtogroupsimilarflowsintoclusters.Forexample,Wangetal.[3]proposedamethodforclusteringnetworktrafficusingnonnegativematrixfactorization.Whilethesemethodshaveshownpromiseindetectingandclassifyingmalicioustraffictheyrequirelargeamountsoflabeleddataandarenotwell-suitedforclassifyingnewtypesofmalwareandattacks.Inadditionclusteringmethodsoftensufferfromlowaccuracyduetothedifficultyinaccuratelydefiningandclusteringnetworktrafficflows.Theproposedalgorithmisbasedonaself-distillationmechanismthatenablestransferlearningfromawell-trainedmodeltoasmallerandlesscomplexmodel.Theself-distillationprocessinvolvestrainingalargeandcomplexmodel(teachermodel)togeneratesofttargetsforasmallerandlesscomplexmodel(studentmodel)thatistrainedtomimicthebehavioroftheteachermodel.Thisprocessenablesthestudentmodeltoeffectivelylearnfromtheknowledgeandexperienceoftheteachermodel,leadingtohigheraccuracywithlesstrainingdata.TheoverallarchitectureoftheproposedalgorithmisshowninFigureThealgorithmconsistsoftwostages:teachermodeltrainingandstudentmodeltraining.Theteachermodelistrainedusingalargelabeleddatasetofnetworktrafficflowsandconsistsofmultipledeepneuralnetworksthatlearntoidentifyandclassifydifferenttypesofmalicioustraffic.Theteachermodelgeneratessofttargets(outputprobabilities)foreachinputexample,whichareusedtotrainthestudentmodel.Thestudentmodelistrainedusingthelabeleddataandthesofttargetsgeneratedbytheteachermodel.Thestudentmodelconsistsofasmallerandlesscomplexneuralnetworkthatisdesignedtomimicthebehavioroftheteachermodel.Duringtraining,thestudentmodelisoptimizedusingthecross-entropylossbetweenthestudentoutputandthesofttargetsgeneratedbytheteachermodel.OncethestudentmodelistraineditcanbeusedtoclassifynewnetworktrafficflowswithlimitedlabeleddataDuringclassification,thestudentmodelgeneratesoutputprobabilitiesthatarecomparedtoapredefinedthresholdtodeterminewhethertheflowismaliciousorbenign.onToevaluatetheperformanceoftheproposedalgorithm,weconductedexperimentsontwocommonlyuseddatasetsISCX-2012andUNSWNBBothdatasetsconsistofnetworktrafficflowslabeledaseitherbenignormalicious.datasetweuseaportionofthelabeleddatafortrainingtheteachermodelandtheremainingdatafortrainingthestudentmodelandevaluatingtheperformanceofthealgorithm.Theperformanceoftheproposedalgorithmisevaluatedusingthefollowingmetricsdetectionrate(DR),falsepositiverate(FPR),andclassificationaccuracy(CA).Table1showstheexperimentalresultsontheISCX-2012dataset.Theresultsshowthattheproposedalgorithmachieveshigherdetectionratesandclassificationaccuracythanotherstate-of-the-artmethodsusinglesslabeleddata.Table2showstheexperimentalresultsontheUNSW-NB15dataset.Again,theproposedalgorithmachieveshigherdetectionratesandclassificationaccuracythanotherstate-of-the-artmethodsusinglesslabeleddata.Theseresultsconfirmtheeffectivenessoftheproposedalgorithmtingandclassifyingmalicioustrafficwithlimitedlabeleddatagselfdistillationtheproposedalgorithmisabletotransfergefromawelltrainedmodeltoasmallerandlesscomplexmodel,whichcanleadtohigheraccuracywithlesstrainingdata.