<abstract xmlns="http://www.w3.org/1999/xhtml">

<p>With the increasingly complex network architecture under the development of information technology, it is more and more difficult to recognize various network traffic. Based on the direction of machine learning for network traffic anomaly detection, this paper proposes a three-stage CNN-LSTM attention mechanism model for feature extraction of original traffic and a PCA-based improvement for spatial feature learning of CNN to construct its anomaly traffic detection model. Meanwhile, based on the abnormal traffic detection, with discriminative network and generative network as the main parts, we propose the cyber security threat intelligence prediction model based on the use of a domain adaptive model to realize the shared representation of source and target domains. In the experiment of the abnormal traffic detection model, the accuracy rate of this paper’s detection model is 93.56%, the check-all rate is 99.2%, the F1 value is 84.9%, and the Kappa value is 80.66%. The detection level in the face of DOS attacks is the highest, with 98.28% and 99.63% checking full rate and checking accuracy, respectively. In the experiments of the network security threat intelligence prediction model, the prediction model of this paper reduces the time consumed by about 72% on average compared to rule file matching in dealing with large-scale network traffic. In high-risk cybersecurity threat attack types, it has an average prediction accuracy of 88.83% and a recall rate of over 90%.</p>
</abstract>

With the increasingly complex network architecture under the development of information technology, it is more and more difficult to recognize various network traffic. Based on the direction of machine learning for network traffic anomaly detection, this paper proposes a three-stage CNN-LSTM attention mechanism model for feature extraction of original traffic and a PCA-based improvement for spatial feature learning of CNN to construct its anomaly traffic detection model. Meanwhile, based on the abnormal traffic detection, with discriminative network and generative network as the main parts, we propose the cyber security threat intelligence prediction model based on the use of a domain adaptive model to realize the shared representation of source and target domains. In the experiment of the abnormal traffic detection model, the accuracy rate of this paper’s detection model is 93.56%, the check-all rate is 99.2%, the F1 value is 84.9%, and the Kappa value is 80.66%. The detection level in the face of DOS attacks is the highest, with 98.28% and 99.63% checking full rate and checking accuracy, respectively. In the experiments of the network security threat intelligence prediction model, the prediction model of this paper reduces the time consumed by about 72% on average compared to rule file matching in dealing with large-scale network traffic. In high-risk cybersecurity threat attack types, it has an average prediction accuracy of 88.83% and a recall rate of over 90%.

Network Security Threat Intelligence Prediction in Network Traffic Analysis Based on Machine Learning

Applied Mathematics and Nonlinear Sciences

This work is licensed under the Creative Commons Attribution 4.0 International License.

With the increasingly complex network architecture under the development of information technology, it is more and more difficult to recognize various network...

Network Security Threat Intelligence Prediction in Network Traffic Analysis Based on Machine Learning

Data publikacji: 07 cze 2024

Zakres stron: -

Otrzymano: 04 mar 2024

Przyjęty: 13 maj 2024

DOI: https://doi.org/10.2478/amns-2024-1447

Słowa kluczowe
Machine learning, CNN-LSTM, PCA, Anomalous traffic, Deep domain adaptation

© 2024 Yankui Guan, published by Sciendo

This work is licensed under the Creative Commons Attribution 4.0 International License.

Network Security Threat Intelligence Prediction in Network Traffic Analysis Based on Machine Learning

Data publikacji: 07 cze 2024

Zakres stron: -

Otrzymano: 04 mar 2024

Przyjęty: 13 maj 2024

DOI: https://doi.org/10.2478/amns-2024-1447

Słowa kluczoweMachine learning, CNN-LSTM, PCA, Anomalous traffic, Deep domain adaptation

© 2024 Yankui Guan, published by Sciendo

This work is licensed under the Creative Commons Attribution 4.0 International License.

Słowa kluczowe
Machine learning, CNN-LSTM, PCA, Anomalous traffic, Deep domain adaptation