WO2021114231A1 - 网络流量异常检测模型的训练方法及检测方法 - Google Patents
网络流量异常检测模型的训练方法及检测方法 Download PDFInfo
- Publication number
- WO2021114231A1 WO2021114231A1 PCT/CN2019/125189 CN2019125189W WO2021114231A1 WO 2021114231 A1 WO2021114231 A1 WO 2021114231A1 CN 2019125189 W CN2019125189 W CN 2019125189W WO 2021114231 A1 WO2021114231 A1 WO 2021114231A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- training
- network
- network traffic
- detection model
- anomaly detection
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2411—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on the proximity to a decision surface, e.g. support vector machines
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
Definitions
- the present invention belongs to the field of information technology, and in particular, relates to a training method and a detection method of a network traffic anomaly detection model, a computer-readable storage medium, and a computer device.
- Abnormal network traffic can more comprehensively reflect the real-time conditions that appear on the network, such as network scanning, DDoS attacks, network worms, etc., and find the network in time. Abnormal traffic changes are of great significance for the abnormal location of the network data center and the corresponding follow-up remedial measures.
- Network traffic anomaly detection has been used as an effective network protection method, which can detect unknown network attack behaviors and provide important support for network situation awareness. In recent years, it has received more and more attention from researchers. For network traffic anomaly detection methods, there are roughly detection methods based on characterization behavior matching, statistics-based anomaly detection methods, machine learning anomaly detection methods, data mining-based anomaly detection methods, and traditional deep learning-based anomaly detection methods.
- Deep learning technology has outstanding advantages in network traffic anomaly detection.
- the deep learning model can take the original data as input and can better describe the rich information of the data from the learned features, and improve the classification performance. Deep learning in different fields can easily adapt to different fields and applications. In the face of the massive information of the network with multiple features, deep learning does not need to perform exploratory data analysis, feature dimensionality reduction and other feature engineering on the current data set.
- the technical problem solved by the present invention is: how to adapt the structure of the neural network model to the characteristics of the network traffic data so as to improve the accuracy of model detection.
- a training method for a network traffic anomaly detection model includes a feature extraction network and a classification network.
- the training method includes:
- the trained feature extraction network is used to extract the abstract feature data of the training sample, and the abstract feature data is used to train the classification network to complete the training of the network traffic detection model.
- the training method further includes:
- the optimized feature extraction network is used to extract the high-level abstract feature data of the training samples, and the high-level abstract feature data is used to train the classification network.
- the method for determining the number of hidden layers according to the training samples is: calculating the number of hidden layers according to the following formula,
- l represents the number of hidden layers
- n represents the data feature dimension of the training sample
- the method for determining the number of neurons in each hidden layer according to the training samples is: calculate the number of neurons according to the following formula,
- e i represents the number of neurons in the i-th layer of the hidden layer
- n represents the data feature dimension of the training sample
- ⁇ is the characteristic influence parameter, 0 ⁇ 1, 1 ⁇ i ⁇ l.
- the training method includes:
- the present invention also discloses a detection method of a network traffic abnormality detection model, and the detection method includes:
- the type of the original network traffic data output by the network traffic anomaly detection model is the type of the original network traffic data output by the network traffic anomaly detection model
- the present invention also discloses a computer-readable storage medium, the computer-readable storage medium stores a training program for a network traffic anomaly detection model, and when the training program for the network traffic anomaly detection model is executed by a processor, the above-mentioned network is realized Training method of traffic anomaly detection model.
- the present invention also discloses a computer device.
- the computer device includes a computer-readable storage medium, a processor, and a training program for a network traffic anomaly detection model stored in the computer-readable storage medium.
- the network traffic anomaly detection When the training program of the model is executed by the processor, the above-mentioned training method of the network traffic anomaly detection model is realized.
- the invention discloses a training method and a detection method for a network traffic anomaly detection model.
- the number of hidden layers of the neural network and the number of neurons in each layer are determined before the model is constructed, so that the network structure can adapt to the network traffic data , To avoid the structure of the detection model being too complex and too simple, thereby reducing the generalization error, can significantly reduce the detection time and improve the detection accuracy.
- Fig. 1 is a flowchart of a method for training a network traffic anomaly detection model according to an embodiment of the present invention
- FIG. 2 is a schematic structural diagram of a trained feature extraction network according to an embodiment of the present invention.
- FIG. 3 is a flowchart of a detection method of a network traffic anomaly detection model according to an embodiment of the present invention
- FIG. 4A is a diagram of experimental results of different models tested on the NSLKDD data set according to an embodiment of the present invention.
- 4B is the detection result of each classifier before and after using the optimized feature extraction network according to the embodiment of the present invention.
- FIG. 4C is the time saving percentage of each classifier after using the optimized feature extraction network according to the embodiment of the present invention.
- Figure 5A is a PCA visualization view of data classification using an existing detection model
- Figure 5B is a PCA visualization view of data classification using the detection model of the present invention.
- Fig. 6 is a functional block diagram of a computer device according to an embodiment of the present invention.
- This application proposes a training method and a detection method for a network traffic anomaly detection model.
- the detection model is established based on a feature adaptation neural network. This method can determine the number of hidden layers of the neural network and the number of neurons in each layer according to the network traffic of multi-dimensional features, thereby establishing a corresponding deep learning network anomaly detection model and pre-training.
- the training method of the network traffic anomaly detection model disclosed in this application mainly includes the training of the feature extraction network and the training of the classification network.
- the training method of the network traffic anomaly detection model includes the following steps:
- Step S10 Determine the number of hidden layers and the number of neurons in each hidden layer according to the training samples.
- the original network traffic data needs to be normalized and cleaned to obtain training samples.
- Read the training data set and the test data set separately from the original network traffic data standardize the network traffic, clean up lost or wrong data or delete irrelevant data, etc., and retain the original meaningful features, among which the training data
- the set and the test data set constitute the training sample.
- training samples are generally used directly to train the corresponding neural network.
- this application first determines the number of hidden layers and the number of neurons before constructing the feature extraction network.
- l represents the number of hidden layers
- n represents the data feature dimension of the training sample, Indicates rounding up.
- the number of hidden layers can be determined according to the data feature dimensions of the training samples, which provides a basis for the subsequent construction of feature extraction networks.
- e i represents the number of neurons in the i-th layer of the hidden layer
- n represents the data feature dimension of the training sample
- ⁇ is the characteristic influence parameter, 0 ⁇ 1, 1 ⁇ i ⁇ l.
- the characteristic influence parameter ⁇ can play a certain adjustment effect on the model, and this value can be selected by multiple selections in the experiment to obtain the optimal value or given by expert experience.
- the purpose of adding ⁇ is to superimpose the number of neurons in each layer Selectively allow the propagation of each hidden layer to retain part of the high-dimensional feature n, so that the network traffic anomaly detection model can adapt to the dimensionality of the data during training, so as to have a better ability to express the characteristics of the data.
- Step S20 Construct an initial feature extraction network according to the number of hidden layers and the number of neurons in each hidden layer.
- the initial feature extraction network can be expressed as xW+b, where W and b both represent parameter variables.
- Step S30 Use training samples to train the initial feature extraction network to obtain a trained feature extraction network.
- the training set T ⁇ (x 1 , y 1 ), (x 2 , y 2 ), (x 3 , y 3 ),..., (x n , y n ) ⁇ to train the initial feature extraction network to obtain .
- the training process is the prior art, which is not described in detail here.
- a brief description of the commonly used parameters in the training process is given, using z l to represent the input of the neuron in the lth layer, a l-1 is the output of the neuron in the upper layer of the l layer, and ⁇ is the activation function set initially .
- Step S40 Use the trained feature extraction network to extract abstract feature data of the training sample, and use the abstract feature data to train the classification network to complete the training of the network traffic detection model.
- the trained feature extraction network includes an input layer 21, a number of hidden layers 22 and a classification layer 23 connected in sequence.
- the trained feature extraction network generates some new abstract features after the feature extraction and transfer operations of its several hidden layers 22, and then can use its own classification layer 23 for classification, so as to predict the abnormal types of the network. Classification, and then use the classification network for further classification, but this method cannot fit the nonlinear features in the feature space well, that is, some features will be lost, resulting in inaccurate subsequent detection results.
- the classification layer 23 in the trained feature extraction network is removed to obtain the optimized feature extraction network
- the optimized feature extraction network is used to extract the high-level abstract feature data of the training sample
- the high-level abstract feature data is used for training
- the classification network is to directly train the classification network using abstract data features extracted by several hidden layers 22.
- the classification network is a common classifier in the field of machine learning. Using the classifier to process these high-level abstract features can perform better classification.
- the present invention also discloses a detection method of a network traffic anomaly detection model, the detection method includes: Step S100: input original network traffic data into the network traffic anomaly detection model obtained by the above training method; S200: The network traffic anomaly detection model outputs the type of the original network traffic data; Step S300: Determine whether the network process is abnormal according to the type of the original network traffic data.
- the detected data set adopts the NSLKDD data set.
- a common support vector machine model SVM is selected.
- the network traffic anomaly detection model in this application is DAFL SVM.
- Specific evaluation indicators include Accuracy, Precision, Recall, F 1 -score and Times.
- the network traffic anomaly detection model adopted in this application has improved compared with the traditional support vector machine model SVM. The time is greatly reduced, that is, the detection speed is greatly improved.
- KNN K-Nearest Neighbors
- LR Logistic Regression
- the fourth comparative example adopts a decision tree classification model (Decision Tree, DT for short)
- the network traffic anomaly detection model of this application is DAFL DT
- the classification network of this application adopts DT
- DAFL represents the feature extraction network of this application
- the feature influence parameter ⁇ 0.8
- the network traffic anomaly detection model adopted in this application has improved various indicators, and the detection time is greatly shortened, that is, the detection speed is greatly improved .
- the dark area represents abnormal data
- the light area represents normal data.
- Figure 5A it can be seen that a traditional machine is used.
- the learning classifier cannot effectively classify normal and abnormal data.
- the obtained data set is chaotic and disorderly.
- the detection model of this application is used to classify, as shown in Figure 5B, the normal and abnormal data can be effectively collected. The data points are classified.
- the network traffic anomaly detection model of the present application has a higher accuracy rate and a lower false alarm rate than common classification models.
- the feature extraction network of the present application It can effectively adapt to different types of classification networks, and also reflects the robustness and scalability of the detection model.
- This application first determines the number of hidden layers of the neural network and the number of neurons in each layer before constructing the model, so that the network structure can adapt to the network traffic data, avoiding the structure of the detection model from being too complicated and too simple, thereby reducing the generalization To reduce the error, it can significantly reduce the detection time and improve the detection accuracy.
- this application is based on the idea of migration learning, first train a complete feature extraction network, and then remove the classification layer of the feature extraction network, let the original data generate new abstract features through the remaining feature extraction network, and let the final classification Learn online.
- Such a purpose can make the newly generated data tend to be ordered, make the traditional machine learning classifier quickly converge to achieve the best classification effect, and can improve the accuracy rate and reduce the detection time.
- the application also discloses a computer-readable storage medium that stores a training program for a network traffic anomaly detection model, and when the training program for the network traffic anomaly detection model is executed by a processor, the above-mentioned network is realized Training method of traffic anomaly detection model.
- the application also discloses a computer device.
- the terminal includes a processor 12, an internal bus 13, a network interface 14, and a computer-readable storage medium 11.
- the processor 12 reads the corresponding computer program from the computer-readable storage medium and then runs it to form a request processing device on a logical level.
- the execution subject of the following processing flow is not limited to each
- the logic unit can also be a hardware or a logic device.
- the computer-readable storage medium 11 stores a training program for a network traffic anomaly detection model, and the training program for the network traffic anomaly detection model is executed by a processor to implement the above-mentioned training method for the network traffic anomaly detection model.
- Computer-readable storage media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology.
- the information can be computer-readable instructions, data structures, program modules, or other data.
- Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only Memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage , Magnetic cassettes, magnetic disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by computing devices.
- PRAM phase change memory
- SRAM static random access memory
- DRAM dynamic random access memory
- RAM random access memory
- ROM read-only Memory
- EEPROM electrically erasable programmable read-only
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Computing Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- General Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- Biophysics (AREA)
- Molecular Biology (AREA)
- General Health & Medical Sciences (AREA)
- Computational Linguistics (AREA)
- Biomedical Technology (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Computer Security & Cryptography (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims (18)
- 一种网络流量异常检测模型的训练方法,其中,所述网络流量异常检测模型包括特征提取网络和分类网络,所述训练方法包括:根据训练样本确定隐藏层的层数和每层隐藏层中的神经元个数;根据所述隐藏层的层数和每层隐藏层中的神经元个数构建初始的特征提取网络;利用训练样本对所述初始特征提取网络进行训练,得到训练完成的特征提取网络;利用训练完成的特征提取网络提取训练样本的抽象特征数据,并利用所述抽象特征数据训练分类网络,以完成网络流量检测模型的训练。
- 根据权利要求1所述的网络流量异常检测模型的训练方法,其中,在得到所述训练完成的特征提取网络之后,所述训练方法还包括:去除所述训练完成的特征提取网络中的分类层,得到优化的特征提取网络;利用优化的特征提取网络提取训练样本的高级抽象特征数据,并利用高级抽象特征数据训练分类网络。
- 根据权利要求4所述的网络流量异常检测模型的训练方法,其中,所述训练方法包括:对原始网络流量数据进行规范化处理和清洗处理,以获得训练样本。
- 一种网络流量异常检测模型的检测方法,其中,所述检测方法包括:将原始网络流量数据输入到由权利要求1所述的训练方法训练得到的网络流量异常检测模型中;所述网络流量异常检测模型输出原始网络流量数据的类型;根据原始网络流量数据的类型判断网络流程是否异常。
- 根据权利要求7所述的网络流量异常检测模型的检测方法,其中,在得到所述训练完成的特征提取网络之后,所述网络流量异常检测模型的训练方法还包括:去除所述训练完成的特征提取网络中的分类层,得到优化的特征提取网络;利用优化的特征提取网络提取训练样本的高级抽象特征数据,并利用高级抽象特征数据训练分类网络。
- 根据权利要求10所述的网络流量异常检测模型的检测方法,其中,所述网络流量异常检测模型的训练方法包括:对原始网络流量数据进行规范化处理和清洗处理,以获得训练样本。
- 一种计算机设备,其中,所述计算机设备包括计算机可读存储介质、处理器和存储在所述计算机可读存储介质中的网络流量异常检测模型的训练程序,所述网络流量异常检测模型的训练程序被处理器执行时实现如权利要求1所述的网络流量异常检测模型的训练方法。
- 根据权利要求13所述的计算机设备,其中,在得到所述训练完成的特征提取网络之后,所述网络流量异常检测模型的训练方法还包括:去除所述训练完成的特征提取网络中的分类层,得到优化的特征提取网络;利用优化的特征提取网络提取训练样本的高级抽象特征数据,并利用高级抽象特征数据训练分类网络。
- 根据权利要求16所述的计算机设备,其中,所述网络流量异常检测模型的训练方法包括:对原始网络流量数据进行规范化处理和清洗处理,以获得训练样本。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201911268314.9A CN111064721A (zh) | 2019-12-11 | 2019-12-11 | 网络流量异常检测模型的训练方法及检测方法 |
CN201911268314.9 | 2019-12-11 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2021114231A1 true WO2021114231A1 (zh) | 2021-06-17 |
Family
ID=70300647
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2019/125189 WO2021114231A1 (zh) | 2019-12-11 | 2019-12-13 | 网络流量异常检测模型的训练方法及检测方法 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN111064721A (zh) |
WO (1) | WO2021114231A1 (zh) |
Cited By (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113542241A (zh) * | 2021-06-30 | 2021-10-22 | 杭州电子科技大学 | 一种基于CNN-BiGRU混合模型的入侵检测方法及装置 |
CN114338853A (zh) * | 2021-12-31 | 2022-04-12 | 西南民族大学 | 一种工业互联网下的区块链流量监检测方法 |
CN114629695A (zh) * | 2022-02-28 | 2022-06-14 | 天翼安全科技有限公司 | 一种网络异常检测方法、装置、设备和介质 |
CN114697139A (zh) * | 2022-05-25 | 2022-07-01 | 杭州海康威视数字技术股份有限公司 | 基于特征迁移的设备异常检测、训练方法、系统和装置 |
CN115623531A (zh) * | 2022-11-29 | 2023-01-17 | 浙大城市学院 | 利用无线射频信号的隐藏监控设备发现和定位方法 |
CN116208356A (zh) * | 2022-10-27 | 2023-06-02 | 浙江大学 | 一种基于深度学习的虚拟货币挖矿流量检测方法 |
CN116893663A (zh) * | 2023-09-07 | 2023-10-17 | 之江实验室 | 一种主控异常检测方法、装置、存储介质及电子设备 |
CN117537951A (zh) * | 2024-01-10 | 2024-02-09 | 西南交通大学 | 一种基于深度学习的超导悬浮器内部温升检测方法及装置 |
CN117830728A (zh) * | 2024-01-02 | 2024-04-05 | 北京天防安全科技有限公司 | 异常流量检测方法、装置、电子设备及介质 |
CN118054972A (zh) * | 2024-04-11 | 2024-05-17 | 石家庄学院 | 基于异常流量样本增强的检测方法、系统、设备及介质 |
Families Citing this family (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113762299A (zh) * | 2020-06-28 | 2021-12-07 | 北京沃东天骏信息技术有限公司 | 一种异常流量检测方法和装置 |
CN112291226B (zh) * | 2020-10-23 | 2022-05-27 | 新华三信息安全技术有限公司 | 一种网络流量的异常检测方法及装置 |
CN114205355B (zh) * | 2021-12-13 | 2022-08-26 | 南方电网数字电网研究院有限公司 | 一种变电网关附属设备性能测试方法、系统及电子设备 |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101686235A (zh) * | 2008-09-26 | 2010-03-31 | 中联绿盟信息技术(北京)有限公司 | 网络异常流量分析设备和方法 |
CN107725283A (zh) * | 2017-09-19 | 2018-02-23 | 江苏方天电力技术有限公司 | 一种基于深度信念网络模型的风机故障检测方法 |
CN107959675A (zh) * | 2017-11-25 | 2018-04-24 | 国网河南省电力公司电力科学研究院 | 配电网无线通信接入的网络异常流量检测方法和装置 |
US20180351823A1 (en) * | 2017-05-31 | 2018-12-06 | Fujitsu Limited | Management apparatus, management method and non-transitory computer-readable storage medium for storing management program |
US20190036952A1 (en) * | 2017-07-28 | 2019-01-31 | Penta Security Systems Inc. | Method and apparatus for detecting anomaly traffic |
CN109728939A (zh) * | 2018-12-13 | 2019-05-07 | 杭州迪普科技股份有限公司 | 一种网络流量检测方法及装置 |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107948166B (zh) * | 2017-11-29 | 2020-09-25 | 广东亿迅科技有限公司 | 基于深度学习的流量异常检测方法及装置 |
CN108334907B (zh) * | 2018-02-09 | 2019-05-17 | 哈尔滨工业大学(威海) | 一种基于深度学习的复杂装备点异常检测方法及系统 |
CN109818798A (zh) * | 2019-02-19 | 2019-05-28 | 上海海事大学 | 一种融合kpca和elm的无线传感器网络入侵检测系统及方法 |
-
2019
- 2019-12-11 CN CN201911268314.9A patent/CN111064721A/zh active Pending
- 2019-12-13 WO PCT/CN2019/125189 patent/WO2021114231A1/zh active Application Filing
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101686235A (zh) * | 2008-09-26 | 2010-03-31 | 中联绿盟信息技术(北京)有限公司 | 网络异常流量分析设备和方法 |
US20180351823A1 (en) * | 2017-05-31 | 2018-12-06 | Fujitsu Limited | Management apparatus, management method and non-transitory computer-readable storage medium for storing management program |
US20190036952A1 (en) * | 2017-07-28 | 2019-01-31 | Penta Security Systems Inc. | Method and apparatus for detecting anomaly traffic |
CN107725283A (zh) * | 2017-09-19 | 2018-02-23 | 江苏方天电力技术有限公司 | 一种基于深度信念网络模型的风机故障检测方法 |
CN107959675A (zh) * | 2017-11-25 | 2018-04-24 | 国网河南省电力公司电力科学研究院 | 配电网无线通信接入的网络异常流量检测方法和装置 |
CN109728939A (zh) * | 2018-12-13 | 2019-05-07 | 杭州迪普科技股份有限公司 | 一种网络流量检测方法及装置 |
Non-Patent Citations (1)
Title |
---|
"Advances in Intelligent Data Analysis XIX", vol. 32, 29 September 2019, SPRINGER INTERNATIONAL PUBLISHING, Cham, ISBN: 978-3-030-71592-2, ISSN: 0302-9743, article JI SHUJIAN; SUN TONGZHENG; YE KEJIANG; WANG WENBO; XU CHENG-ZHONG: "DAFL: Deep Adaptive Feature Learning for Network Anomaly Detection", pages: 350 - 354, XP047524227, DOI: 10.1007/978-3-030-30709-7_32 * |
Cited By (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113542241A (zh) * | 2021-06-30 | 2021-10-22 | 杭州电子科技大学 | 一种基于CNN-BiGRU混合模型的入侵检测方法及装置 |
CN114338853A (zh) * | 2021-12-31 | 2022-04-12 | 西南民族大学 | 一种工业互联网下的区块链流量监检测方法 |
CN114338853B (zh) * | 2021-12-31 | 2022-09-20 | 西南民族大学 | 一种工业互联网下的区块链流量监检测方法 |
CN114629695A (zh) * | 2022-02-28 | 2022-06-14 | 天翼安全科技有限公司 | 一种网络异常检测方法、装置、设备和介质 |
CN114697139A (zh) * | 2022-05-25 | 2022-07-01 | 杭州海康威视数字技术股份有限公司 | 基于特征迁移的设备异常检测、训练方法、系统和装置 |
CN114697139B (zh) * | 2022-05-25 | 2022-09-02 | 杭州海康威视数字技术股份有限公司 | 基于特征迁移的设备异常检测、训练方法、系统和装置 |
CN116208356A (zh) * | 2022-10-27 | 2023-06-02 | 浙江大学 | 一种基于深度学习的虚拟货币挖矿流量检测方法 |
CN116208356B (zh) * | 2022-10-27 | 2023-09-29 | 浙江大学 | 一种基于深度学习的虚拟货币挖矿流量检测方法 |
CN115623531B (zh) * | 2022-11-29 | 2023-03-31 | 浙大城市学院 | 利用无线射频信号的隐藏监控设备发现和定位方法 |
CN115623531A (zh) * | 2022-11-29 | 2023-01-17 | 浙大城市学院 | 利用无线射频信号的隐藏监控设备发现和定位方法 |
CN116893663A (zh) * | 2023-09-07 | 2023-10-17 | 之江实验室 | 一种主控异常检测方法、装置、存储介质及电子设备 |
CN116893663B (zh) * | 2023-09-07 | 2024-01-09 | 之江实验室 | 一种主控异常检测方法、装置、存储介质及电子设备 |
CN117830728A (zh) * | 2024-01-02 | 2024-04-05 | 北京天防安全科技有限公司 | 异常流量检测方法、装置、电子设备及介质 |
CN117537951A (zh) * | 2024-01-10 | 2024-02-09 | 西南交通大学 | 一种基于深度学习的超导悬浮器内部温升检测方法及装置 |
CN117537951B (zh) * | 2024-01-10 | 2024-03-26 | 西南交通大学 | 一种基于深度学习的超导悬浮器内部温升检测方法及装置 |
CN118054972A (zh) * | 2024-04-11 | 2024-05-17 | 石家庄学院 | 基于异常流量样本增强的检测方法、系统、设备及介质 |
Also Published As
Publication number | Publication date |
---|---|
CN111064721A (zh) | 2020-04-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2021114231A1 (zh) | 网络流量异常检测模型的训练方法及检测方法 | |
Schwab et al. | Cxplain: Causal explanations for model interpretation under uncertainty | |
Yao et al. | Unsupervised anomaly detection using variational auto-encoder based feature extraction | |
CN111242199B (zh) | 图像分类模型的训练方法及分类方法 | |
CN111753985B (zh) | 基于神经元覆盖率的图像深度学习模型测试方法与装置 | |
Qi et al. | Deep face clustering using residual graph convolutional network | |
JP2022500745A (ja) | 異常検出および/または予知保全のためのコンピュータ実装方法、コンピュータプログラム製品およびシステム | |
CN107133628A (zh) | 一种建立数据识别模型的方法及装置 | |
CN111222638B (zh) | 一种基于神经网络的网络异常检测方法及装置 | |
CN109787958B (zh) | 网络流量实时检测方法及检测终端、计算机可读存储介质 | |
KR102362872B1 (ko) | 인공지능 학습을 위한 클린 라벨 데이터 정제 방법 | |
He et al. | WKN-OC: a new deep learning method for anomaly detection in intelligent vehicles | |
Gopali et al. | A comparative study of detecting anomalies in time series data using LSTM and TCN models | |
Wayahdi et al. | Evaluation of the K-Nearest Neighbor Model With K-Fold Cross Validation on Image Classification | |
WO2021244105A1 (zh) | 一种特征向量维度压缩方法、装置、设备、介质 | |
CN113343123A (zh) | 一种生成对抗多关系图网络的训练方法和检测方法 | |
CN117197591A (zh) | 一种基于机器学习的数据分类方法 | |
CN115481694B (zh) | 一种训练样本集的数据增强方法、装置、设备及存储介质 | |
Chen et al. | GAIA: delving into gradient-based attribution abnormality for out-of-distribution detection | |
CN113312968B (zh) | 一种监控视频中的真实异常检测方法 | |
JP7006724B2 (ja) | 分類装置、分類方法、及び、プログラム | |
CN110728310B (zh) | 一种基于超参数优化的目标检测模型融合方法及融合系统 | |
Zhou et al. | Imbalanced data classification for defective product prediction based on industrial wireless sensor network | |
Zhang et al. | Surface defect detection method based on neural architecture search | |
Lian et al. | Anomaly Detection Modeling Based on Self-Adaptive Threshold Voting Integrating DBN-LRs |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 19956032 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 19956032 Country of ref document: EP Kind code of ref document: A1 |
|
32PN | Ep: public notification in the ep bulletin as address of the adressee cannot be established |
Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11.01.2023) |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 19956032 Country of ref document: EP Kind code of ref document: A1 |