期刊
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT
卷 19, 期 1, 页码 73-88出版社
IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC
DOI: 10.1109/TNSM.2021.3131266
关键词
Feature extraction; Semantics; Tools; Protocols; Deep learning; Anomaly detection; Training; Semantic-aware traffic detection; latent Dirichlet; pseudo samples generation; few-shot; machine learning; network security
资金
- National Natural Science Foundation of China [U20B2048]
- Shanghai Sailing Program [21YF1421700]
This paper proposes a Few-shot Latent Dirichlet Generative Learning (FLAG) scheme for semantic-aware traffic detection. By using a pseudo sample generation algorithm based on Latent Dirichlet Allocation (LDA) and a Fuzziness Recycle Method (FRM), efficient detection with few-shot samples is achieved and the accuracy of traffic classification is improved.
The number of malware attempts that try to bypass the existing Network Intrusion Detection System (NIDS) is increasing. To detect illegal access to servers, deep analysis of the server-side network traffic has become increasingly important. However, the existing approaches have serious performance limitations in terms of real-time and accurate traffic detection. These limitations are mainly because of i) the rigid feature extraction and rule matching techniques of NIDS, which are insensitive to incremental network traffic, and ii) the strong correlation and coupling of malicious traffic to large normal traffic. To address these limitations, we propose a Few-shot Latent Dirichlet Generative Learning (FLAG) scheme for semantic-aware traffic detection in this paper. In FLAG, a Latent Dirichlet Allocation (LDA)-based pseudo samples generation algorithm is designated to augment the few-shot training data, which is essential to improve traffic classification accuracy. Furthermore, we propose a Fuzziness Recycle Method (FRM) to further improve the long short-term memory (LSTM)-based classifier's robustness. Experimental results in real scenarios demonstrate that malicious traffic can be efficiently detected when only few-shot samples are learned. The results also reveal that the proposed scheme outperforms the state-of-the-art methods in detection accuracy.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据