Unbalanced abnormal traffic detection based on improved Res-BIGRU and integrated dynamic ELM optimization

Ma, Wengang; Zhang, Yadong; Guo, Jun; Li, Kehong

doi:10.1016/j.comcom.2021.08.005

Cited by 14 publications

(5 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…W and b denote the weight matrix and bias vector of the corresponding part, t x denotes the input sequence at moment t , t h denotes the output vector at the previous moment,  denotes the sigmoid activation function, and tanh denotes the hyperbolic tangent activation function. 5)- (10). The global mapping of the spatial features of network traffic data through the LSTM layer gives the model a stronger global memory for network traffic features, thus improving the characterization ability of the network.…”

Section: ) Lstmmentioning

confidence: 99%

“…Literature [9] describes in detail the workflow of applying deep learning for network anomaly detection and the principles of several deep learning models. Literature [10] proposes to construct a three-layer stacked LSTM network model to extract the network traffic features at different depths and improve the accuracy of detection. To improve the generalization ability of deep learning models, Xin-Tong Wang et al [11] combined multi-scale one-dimensional convolution with long and short-term memory networks, which effectively enhanced the characterization ability of the model.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Anomaly detection of terminal access based on LSTM and ResNet

et al. 2023

Second International Symposium on Computer Applications and Information Systems (ISCAIS 2023)

View full text Add to dashboard Cite

Massive wireless debugging terminals and complex and diverse access requirements pose significant challenges to the secure access of substation terminal equipment. It is crucial to detect anomaly network traffic to ensure the security of terminal access to the substation. At present, network traffic anomaly detection based on traditional deep learning often has the problem of low computational efficiency or weak representation ability. Given the low computational efficiency of traditional deep learning, the residual network is used to extract spatial features of data, which can effectively improve convergence speed and time efficiency. Aiming at the problem of weak representation ability of traditional machine learning methods, the long short-term memory network (LSTM) is used to improve the representation ability to learn while learning the temporal characteristics of traffic and prevent the gradient from disappearing and network degradation. Experimental results show that compared with the traditional deep learning method, the accuracy of the proposed method is improved, the F1 score reaches 90.09, and the AUC is up to 0.981. By improving anomaly detection accuracy, the paper further guarantees terminal security.

show abstract

Section: ) Lstmmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Anomaly detection of terminal access based on LSTM and ResNet

et al. 2023

Second International Symposium on Computer Applications and Information Systems (ISCAIS 2023)

View full text Add to dashboard Cite

show abstract

“…In recent years, researchers have paid attention to the research of network traffic identification technology [2][3][4][5] [6] . The identification technology can be divided into four classes, they are port number based, payload or DPI (Deep Packet Inspection) based, machine learning based as well as deep learning-based traffic identification.…”

Section: Related Workmentioning

confidence: 99%

VPN encrypted traffic identification model based on improved residual network

Li,

Zhang,

et al. 2023

Third International Conference on Advanced Algorithms and Signal Image Processing (AASIP 2023)

View full text Add to dashboard Cite

Accurate classification of network traffic is the research basis for tasks such as network management, service quality optimization, abnormal traffic detection, etc. Aiming at the problems of incomplete feature extraction of existing methods, a VPN encrypted traffic identification model based on improved residual network is proposed. The model takes the conversation composed of bidirectional flows as the analysis object, first uses the multi-layer convolutional network to extract the spatial structure features of the conversation, then introduces the improved residual unit to increase the width of the backbone network, and uses 1x1 and 3x3 different sizes of convolution kernels on the same level to obtain different scale feature information, and improve the model’s feature representation ability. Finally, the extracted features are expanded into one-dimensional vectors and Softmax funciton is used to classify the encrypted traffic. The Experimental results on public VPN-non VPN dataset show that the proposed model performs better than traditional identification methods, and compared with the well-known methods, the accuracy, precision and recall metrics are improved by 3.32%, 2.65% and 3.79%, respectively.

show abstract

“…This approach offers an accuracy of 95.43% to 97.81% in the evasion attack dataset and 81.25% to 99.92% in the UNM dataset. Ma et al 35 used an improved bidirectional residual gated recurrent unit (Res‐BIGRU) and integrated dynamic extreme learning machine (IDELM) for unbalanced abnormal traffic detection. The performance is evaluated using four networks and one IoT dataset.…”

Section: Review Of Related Workmentioning

confidence: 99%

Malicious behavior detection in cloud using self‐optimized dynamic kernel convolutional neural network

Alajlan

Almasri

2022

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Cloud computing is one example of a technological revolution that has drastically altered the way traditional commercial operations are conducted. Because cloud platforms are fundamentally revolutionizing the area of computing, they must provide safe transmission and storage of user data by assuring the confidentiality, integrity, and availability of the data. As a result, establishing a secure cloud computing framework is crucial, and security cannot only rely on the user's credentials being verified. To overcome this problem, this article presents a multi‐population genetic algorithm optimized dynamic kernel convolutional neural network to analyze the user's behavior to identify their malicious intent. This article describes a two‐stage malicious detection and prediction scheme. The proposed system's efficiency is measured by its ability to discriminate between nine different types of attacks in the UNSW‐NB15 dataset (abnormal behavior exhibited by users). The average true positive rate, false positive rate, precision, and F‐measure for the nine attack classes were 99.22%, 99.11%, 99.11%, and 99.22%, respectively, when evaluated using the UNSW‐NB15 dataset. The experimental results demonstrate that this technique is effective in detecting malicious behaviors in the cloud environment with higher accuracy.

show abstract

Unbalanced abnormal traffic detection based on improved Res-BIGRU and integrated dynamic ELM optimization

Cited by 14 publications

References 20 publications

Anomaly detection of terminal access based on LSTM and ResNet

Anomaly detection of terminal access based on LSTM and ResNet

VPN encrypted traffic identification model based on improved residual network

Malicious behavior detection in cloud using self‐optimized dynamic kernel convolutional neural network

Contact Info

Product

Resources

About