應用卷積深度神經網路於DDoS攻擊偵測初探

林文暉 ； 王平 ； 吳保樺 ； 蔡政穎

《NCS 2017 全國計算機會議》 2017 (2018/01) Pp. 904-908

https://doi.org/10.29428/9789860544169.201801.0169

摘要

傳統網路威脅分析方法常以行為關聯分析技術，搭配封包過濾檢視，耗費大量人力與物力，無法趕上新型態網路威脅播的速度，故網路入侵偵測急需一種快速且準確判斷的方法。深度學習(Deep Learning, DL)本質上是透過多層深度類神經網路(Deep Neural Network, DNN)架構以提供自動化特徵學習與類別映射，解決傳統離線特徵分析耗費大量人力的瓶頸。本研究從歷史網路流中擷取分散式阻斷服務(DDoS)中入侵偵測攻擊的基本行為特徵，然後將特徵矩陣映射為灰度圖像，再運用卷積神經網路(Convolutional Neuron Network, CNN)結合搭配誤差反向傳播（back propagation）演算法遞迴，修正LeNet-5網路架構進行學習，分離出抽象特徵用以呈現網路流資訊與入侵偵測的行為的關聯，用以檢測具惡意連線的攻擊型態。訓練CNN網路實驗結果發現DDoS攻擊中入侵偵測資料集樣本中攻擊類型蒐集不均勻時，模式將無法達到預期偵測的精確度；本研究提出兩項案例應用於訓練資料前處理作法，可有效提升模式精確度並加快學習速度，以供後續研究參考。

關鍵字

分散式阻斷服務 ； 深度學習 ； 卷積神經網路 ； 行為特徵 ； 網路連線偵測

並列摘要

Most existing approaches for solving the network threat problems focus on the behavioural feature analysis using association analysis and pattern filtering; it costs a lot of manpower and financial resources. However, it cannot catch up with the spread speed of new cyber threats. Essentially, Deep Learning (DL) uses deep neural networks (DNNs) through the multi-layer architecture to perform feature learning and class mapping from intrusion detection datasets. Accordingly, this study focused on DDoS detection using convolutional neuron networks (CNNs) with back propagation approach base on LeNet-5 thru behavioral feature selection, transformation, and comparison to classify the malware. The experiment results show that the expected detection accuracy cannot be achieved if the number of samples in 39 attack types for intrusion detection datasets is not uniform. To speed up the model learning with the high accuracy, the present study make suggestions on training dataset which is used to build the classification model thru use of two case studies of intrusion detection.

並列關鍵字

DDoS ； Deep Learning ； convolutional neuron networks ； behavior features ； malware detection