1. Unbalanced abnormal traffic detection based on improved Res-BIGRU and integrated dynamic ELM optimization
- Author
-
Jin Guo, Kehong Li, Wengang Ma, and Yadong Zhang
- Subjects
Computer Networks and Communications ,Computer science ,business.industry ,Activation function ,Pattern recognition ,Intrusion detection system ,Overfitting ,Residual ,Set (abstract data type) ,ComputingMethodologies_PATTERNRECOGNITION ,Recurrent neural network ,Robustness (computer science) ,Artificial intelligence ,business ,Extreme learning machine - Abstract
Problems such as a vanishing gradient and overfitting will occur when a recurrent neural network (RNN) is exploited to detect abnormal network traffic. In addition, some network traffic is unbalanced, which leads to low detection accuracy. Therefore, an unbalanced abnormal traffic detection method has been proposed. It is composed of the improved bidirectional residual gated recurrent unit (Res-BIGRU) and integrated dynamic extreme learning machine (IDELM). First, the candidate hidden state activation function of the GRU is changed into an unsaturated activation function. The residual connection is used to avoid the vanishing gradient. The purpose of alleviating network degradation is achieved, and the traffic features extracted are better. Second, an IDELM is proposed to solve the unbalanced classification. The minority samples are generated by the IDELM model. The set model in game theory is used to compute the combined weight, which improves the fitting effect. Third, two IDELMs are used to update the final classification results. Fourth, four network datasets and IoT datasets are used to verify the performance. The average accuracy on four network datasets is 91.11% when samples are unbalanced. Furthermore, it can be concluded that the improved Res-BIGRU and IDELM strategy is effective. Better classification results can be achieved when network traffic is unbalanced. In particular, the performance is better in unbalanced NSL-KDD datasets. The index values obtained are the best compared with other methods. It is also suitable for intrusion detection of the Internet of Things, which has good performance. The further advantage lies in that the robustness is better when there are other sample interferences.
- Published
- 2021