Aligning Network Traffic for Serial Consistency and Anomalies with A Customized LSTM Model
Qiuzhuang Yuan, Songjie Wei · 2018
With the rapid development and wide application of the Internet, many researchers have paid attention to the problem of network security. As an active security defense technology, network anomaly detection plays an important role in ensuring network security. Traditional machine learning algorithm is difficult to identify rare attacks and the accuracy of multi-classification detection is low, to solve this problem, we propose an anomaly behavior detection model based on Long Short-Term Memory (LSTM). The first step is to preprocess the network traffic data. Then, we used the principal component analysis (PCA) method to reduce the dimensionality of the high-dimensional traffic data to extract important features. A special LSTM network model is designed to explore and model the characteristics of network traffic data and the serial consistency between the data. The experimental results show that the model has higher detection accuracy for abnormal traffic than the traditional machine learning based anomaly detection model, and also there is a certain detection rate for the new type of attack that does not appear in the training set.