一種基于自蒸餾的自適應(yīng)惡意流量分類(lèi)算法流量的增長(zhǎng)給網(wǎng)絡(luò)安全監(jiān)測(cè)和攻擊防御帶來(lái)了挑戰(zhàn)，網(wǎng)絡(luò)需要開(kāi)發(fā)新的分類(lèi)方法和技術(shù)來(lái)應(yīng)對(duì)。本論文介紹了一種基于自適應(yīng)惡意流量分類(lèi)算法，該算法使用深度神經(jīng)網(wǎng)絡(luò)和自蒸餾和分類(lèi)惡意流量。我們?cè)诔Ｒ?jiàn)的數(shù)據(jù)集上進(jìn)行了實(shí)驗(yàn)驗(yàn)證，結(jié)AbstractTheproliferationofmaliciousnetworktraffichasposedchallengesfornetworksecuritymonitoringandattackdefense,andcybersecurityexpertsneedtodevelopnewclassificationmethodsandtechniquestocombatitThispaperintroducesaself-distillation-basedadaptivemalicioustrafficclassificationalgorithmthatusesdeepneuralnetworksandselfdistillationmechanismtoidentifyandclassifymalicioustraffic.Weconductedexperimentsoncommondatasets,andtheresultsshowthatthealgorithmachieveshighrecognitionandclassificationaccuracy.elfdistillationmalicioustrafficdeepneuralnetworksclassificationaccuracy.Withtheincreasingsophisticationofcyberthreats,traditionalrule-basedandsignaturebasedapproachesarenolongersufficienttoprotectnetworksfrommalicioustraffic.Malwareauthorsusesophisticatedevasiontechniquestoavoiddetectionandintrusionpreventionsystemshaveadifficulttimekeepingupwiththeadvancedtechniquestheyusetoinfectmachines.Asaresult,networksecurityexpertsmustturntomoreadvancedtechnologiestodetectandmitigaterisksposedbymalicioustraffic.hasemergedasapromisingtechnologyfordetectingandclassifyingmalicioustrafficinrecentyearsItiscapableofprocessinglargeamountsofunstructureddataandautomaticallylearningfrompatternsandfeaturesindataInaddition,deeplearningmodelscanadapttonewdatainputsovertimeandimprovetheiraccuracywithmoretrainingdataHoweverdeeplearningmodelsoftenrequirelargeamountsoflabeleddatatoachievehighaccuracy,whichisasignificantchallengeinthecontextofnetworktrafficclassificationduetothelackoflabeleddatafordifferenttypesofmalicioustraffic.Toaddressthischallenge,thispaperpresentsaself-distillation-basedadaptivemalicioustrafficclassificationalgorithmthatcanimprovetheaccuracyofdeepneuralnetworkswithlimitedlabeleddata.Specificallyweuseaself-distillationmechanismtotransferknowledgefromawelltrainedmodeltoasmallerandlesscomplexmodel,whichcanthenbeusedtoclassifymalicioustrafficwithlimitedlabeleddata.Severaltechniqueshavebeenproposedfortheclassificationofmalicioustraffic,includingmachinelearningmethodsandclusteringmethodsMachinelearningmethodsarebasedonmathematicalmodelsandlearnpatternsfromlabeleddata.Forexample,Zhangetal.[1]proposedamalwaredetectionapproachusingamulti-classsupportvectormachineChenetal.[2]proposedadeeplearningapproachformalwaredetectionusingconvolutionalneuralnetworks.Clusteringmethodsarebasedonthesimilarityofnetworktrafficflowsandaimtogroupsimilarflowsintoclusters.Forexample,Wangetal.[3]proposedamethodforclusteringnetworktrafficusingnonnegativematrixfactorization.Whilethesemethodshaveshownpromiseindetectingandclassifyingmalicioustraffictheyrequirelargeamountsoflabeleddataandarenotwell-suitedforclassifyingnewtypesofmalwareandattacks.Inadditionclusteringmethodsoftensufferfromlowaccuracyduetothedifficultyinaccuratelydefiningandclusteringnetworktrafficflows.Theproposedalgorithmisbasedonaself-distillationmechanismthatenablestransferlearningfromawell-trainedmodeltoasmallerandlesscomplexmodel.Theself-distillationprocessinvolvestrainingalargeandcomplexmodel(teachermodel)togeneratesofttargetsforasmallerandlesscomplexmodel(studentmodel)thatistrainedtomimicthebehavioroftheteachermodel.Thisprocessenablesthestudentmodeltoeffectivelylearnfromtheknowledgeandexperienceoftheteachermodel,leadingtohigheraccuracywithlesstrainingdata.TheoverallarchitectureoftheproposedalgorithmisshowninFigureThealgorithmconsistsoftwostages:teachermodeltrainingandstudentmodeltraining.Theteachermodelistrainedusingalargelabeleddatasetofnetworktrafficflowsandconsistsofmultipledeepneuralnetworksthatlearntoidentifyandclassifydifferenttypesofmalicioustraffic.Theteachermodelgeneratessofttargets(outputprobabilities)foreachinputexample,whichareusedtotrainthestudentmodel.Thestudentmodelistrainedusingthelabeleddataandthesofttargetsgeneratedbytheteachermodel.Thestudentmodelconsistsofasmallerandlesscomplexneuralnetworkthatisdesignedtomimicthebehavioroftheteachermodel.Duringtraining,thestudentmodelisoptimizedusingthecross-entropylossbetweenthestudentoutputandthesofttargetsgeneratedbytheteachermodel.OncethestudentmodelistraineditcanbeusedtoclassifynewnetworktrafficflowswithlimitedlabeleddataDuringclassification,thestudentmodelgeneratesoutputprobabilitiesthatarecomparedtoapredefinedthresholdtodeterminewhethertheflowismaliciousorbenign.onToevaluatetheperformanceoftheproposedalgorithm,weconductedexperimentsontwocommonlyuseddatasetsISCX-2012andUNSWNBBothdatasetsconsistofnetworktrafficflowslabeledaseitherbenignormalicious.datasetweuseaportionofthelabeleddatafortrainingtheteachermodelandtheremainingdatafortrainingthestudentmodelandevaluatingtheperformanceofthealgorithm.Theperformanceoftheproposedalgorithmisevaluatedusingthefollowingmetricsdetectionrate(DR),falsepositiverate(FPR),andclassificationaccuracy(CA).Table1showstheexperimentalresultsontheISCX-2012dataset.Theresultsshowthattheproposedalgorithmachieveshigherdetectionratesandclassificationaccuracythanotherstate-of-the-artmethodsusinglesslabeleddata.Table2showstheexperimentalresultsontheUNSW-NB15dataset.Again,theproposedalgorithmachieveshigherdetectionratesandclassificationaccuracythanotherstate-of-the-artmethodsusinglesslabeleddata.Theseresultsconfirmtheeffectivenessoftheproposedalgorithmtingandclassifyingmalicioustrafficwithlimitedlabeleddatagselfdistillationtheproposedalgorithmisabletotransfergefromawelltrainedmodeltoasmallerandlesscomplexmodel,whichcanleadtohigheraccuracywithlesstrainingdata.