Feature identification and processing strategies of machine learning techniques in big data traffic analysis

Twin neural networks [18] were first used for face recognition, which belongs to a type of machine learning that consists of two branches of a neural network, where the weights of the neural network are shared. The outputs of the two branches can then be used to determine how similar the inputs of the two branches are. Because the input to a twin neural network is a sample pair, the network can increase the amount of training data and make full use of the limited dataset to train the neural network, so it is very suitable for small sample learning. In this paper, we propose the full convolutional twin network (SiamFC) algorithm [19], which utilizes a deep convolutional neural network as a function to accomplish similarity learning using a deep network of twin architecture, this method greatly accelerates the computational speed, while simplifying the similarity computation process, which makes the twin neural network more practical in the field of large data traffic feature learning.

SCNN (Convolutional Twin Network) consists of two convolutional neural networks sharing parameters and weights, firstly, a pair of support set traffic data samples and query set traffic data samples are inputted into two identical convolutional neural networks, the traffic data passes through convolutional and pooling layers, and its features are extracted into the feature space, and finally, the feature distances between the two pairs of samples are calculated by the distance function, and if the feature distances of the two samples are are similar, then they are in the same category, otherwise they are in different categories. The samples are fed into the SCNN model and the features extracted by the convolutional neural (CNN) are as follows: (1) fxi=CNNecdxi,θencoding where θencoding is the coding parameter of the CNN. For the Euclidean distance between two features is represented as follows: (2) Dfxi,fxj=fxi−fxj2

The output through the fully connected and SoftMax layers is represented as follows: (3) Pxi,xj=SoftMaxFCDfxi,fxj

The contrast loss function is used in SCNN to process the relevant paired data of the twin neural network with the expression: (4) LW,Y,X1,X2=12N∑n=1NYDw2+(1−Y)maxm−Dw,02 (5) DwX1,X2=X1−X22=∑i=1pX1i−X2i212

Where Equation (5) represents the Euclidean distance (two-paradigm number) between two big data flow samples features X1 and X2 , P represents the feature dimension of the samples, Y is the label of whether the two samples match or not, Y=1 represents that the two samples are similar and Y=0 represents that they are not similar, m is the set threshold, and N is the number of samples.

The SAE-SCNN model consists of a stacked self-coding neural network (SAE) [20] and a twin neural network (SCNN), in which the neural network constructed by the SAE is used as the input to the twin network, the SAE is used for traffic feature extraction, and the twin network (SCNN) is used to classify the anomalous traffic, that is, the Euclidean distance function is used for the traffic samples to obtain a further measure of the similarity of the two sample pairs.The SAE model structure flowchart is shown in Fig. 1. The SAE is a neural network containing multiple layers of sparse self-encoders, where the output of each layer is used as the input of the next layer. The sparse self-encoder provides inputs to each layer of the SAE network through unsupervised parameter initialization, followed by self-encoding training to obtain the hidden features of each layer as learning outcomes. The next layer of the network needs to input the output of the previous layer of the network as a way to carry out the self-coding training. Unsupervised training of the SAE network is then carried out layer by layer and finally the whole network is validated using labeled traffic data and then the SAE network parameters are tuned using gradient descent method.

Figure 1.

SAE model structure process

For feature extraction of big data traffic, a stacked self encoding neural network (SAE) is trained.SAE contains multiple implicit layers which are composed of encoding part and decoding part of multiple AEs.The encoding formula of SAE is as follows: (6) am=fzm (7) z(m+1)=W(m,1)am+b(m,1)

Its decoding formula is: (8) a(n+m)=fz(n+m) (9) z(m+n+1)=W(n−m,1)a(n+m)+b(n−m,2)

Where an is the activation value of the deep hidden unit, W(k,1) , W(k,2) , b(k,1) , b(k,2) , denote the W(1) , W(2) , b(1) , b(2) parameters corresponding to the k th self-encoder, n is the number of neurons, and m is the number of layers of the neural network. The implicit layer of the last selfencoder is then input into the classifier of the SAE-SCNN model as a higher-order feature representation of the input data, thus realizing the big data traffic feature classification.The SAE-SCNN model is a three-layer twin neural network, which consists of a SAE layer, a pooling layer, and an output layer.The neurons in the SAE layer neuronically x transform the traffic sample data into f(x) , and then go through the pooling layer for pooling, and finally the test set samples are predicted using a classifier through the output layer.

Normal traffic on a network is usually uniform, continuous and protocol compliant. While abnormal traffic such as DoS attack traffic is irregular, sudden, large amount of traffic that violates the protocol specification.DoS attack [21] is a kind of and very destructive attack, which is a threat to the Internet and has a strong concealment, DoS attack traffic and typical normal traffic are highly similar and not easy to be detected, so the overall performance of the big data traffic identification model is evaluated by using the type of DoS attack as the Example of abnormal traffic detection for research and analysis. The experiments in this paper use the intrusion detection evaluation dataset CICIDS2017 from the Canadian Cybersecurity Group Research Institute and the public intrusion detection dataset UNSW-NB15 created by the Australian Center for Cybersecurity (ACCS) labs.The number of big data traffic instances in the CICIDS2017 dataset and the UNSW-NB15 dataset are 2563416 and 174852, respectively. 2563416 and 174852, the number of features contains 75 and 45, and the number of categories is 14 and 11, respectively. Both datasets can reflect the characteristics of contemporary big data network intrusion detection traffic, and the DoS traffic data from the two datasets are collected as research instances during the overall performance analysis of the traffic identification model. The entire data was used for experiments during step-by-step independent validation.

The CICIDS2017 dataset is the largest type of dataset available online and contains the most important characteristics of a valid IDS, i.e., anonymity, attack diversity, complete captures, complete interactions, complete network configurations, available protocols, complete traffic, feature sets, metadata, heterogeneity, and tagging. The dataset also contains necessary and updated examples of attacks such as port scanning, botnets, SQL injection, and distributed denial of service (DDoS). Previous publicly available datasets lacked traffic diversity, capacity, anonymized packets, and message payload issues. Instead, this dataset spans eight different files with 79 characteristics per flow, including destination port, flow duration, SYN flag counts, etc. The CICIDS2017 dataset and the UNSW-NB15 dataset contain a detailed description of the types of big data traffic as shown in Table 1. The CICIDS2017 dataset and the UNSW-NB15 dataset contain six and five types of traffic, the ratio of training set to test set is 7:3 for both datasets, and both datasets have the highest number of normal traffic.

The traffic classification confusion matrices of the big data traffic feature recognition and processing model proposed in this paper for the two test datasets are shown in Fig. 3, (a) and (b) represent the classification confusion matrices in the tests on the CICIDS2017 dataset and the UNSW-NB15 dataset, respectively. By observing the diagonal data of the confusion matrices, it can be seen that the model has a higher classification accuracy for all types of big data traffic when classifying and identifying the traffic in the two experimental datasets, except for the malicious traffic in the Heartbleed category in the CICIDS2017 dataset, which has a lower classification accuracy (88.74%).DoS GoldenEye, DoS Hulk, DoS SlowHTTPTest and DoS SlowLoris can reach more than 95% accuracy in identifying the four types of malicious traffic, probably because these four types of attacking malicious traffic have strong temporal correlation, and the model can extract their features well. The normal class of traffic is recognized with an accuracy of 99.68% and 97.84%. This indicates that these classes of traffic have high class consistency, and the traffic feature recognition and classification model fully learns their features.The Heartbleed class of malicious attack traffic has less training data, so the recognition accuracy is lower.

Figure 3.

The model of the classification confusion matrix in the test set

1)

Performance evaluation index

In order to verify the accuracy and generalization ability of the big data traffic recognition method proposed in this paper, relevant experiments are subsequently conducted in this paper. In terms of hardware, the experiments used devices equipped with E5-2678 CPUs and NVIDIATITAN RTX GPUs. In terms of the software environment, version 3.8.16 of the Python interpreter was used in combination with several key python libraries, including but not limited to numpy, pandas, scapy, scikit-learn, and torch, for data processing and machine learning-based big data traffic identification tasks. The above hardware and software configurations can ensure the reproducibility and scientific validity of big data traffic recognition experiments. In this paper, the model performance is evaluated using Precision, Recall, Accuracy and F1-Score, which provide a comprehensive assessment of the model capability. In these four metrics, Positive (Positive) refers to large data traffic anomaly samples and Negative (Negative) refers to normal traffic samples.

Precision measures the proportion of all samples predicted by the model to be Positive that are also Positive in terms of their true labels. The calculation is shown in (10): (10) Precision=TPTP+FP

The Recall assessment measures the proportion of all samples in which the true label is a positive case and the prediction is also a positive case. The calculation is shown in (11): (11) Recall=TPTP+FN

Accuracy measures the proportion of predictions that are correct across all samples. It is calculated as: (12) Accuracy=TP+TNTP+TN+FP+FN

The F1-Score is the reconciled mean of precision and recall, and is suitable for evaluating the model’s balanced identification effectiveness for unbalanced category distributions. It is calculated as in (13): (13) F1−Score=2×Precision×RecallPrecision+Recall

TP , TN , FP and FN in the above equations refer to the true example, true counterexample, false positive example and false counterexample respectively.

The previous section has carried out experimental validation of the model effectiveness on the dataset, comparing the recognition effect of the model on the public dataset. This section focuses on building a system in the OPNET simulation environment and applying the traffic detection model proposed in this paper to the system to accurately reproduce and analyze various behaviors and performances during traffic attack and defense under OPNET, and to validate the reliability of the model in this paper in real network traffic attack and defense scenarios. The network nodes in the simulation environment can be managed in the virtual machine by connecting the OpenDayLight controller deployed in the virtual machine to the OpenFlow switch nodes in OPNET. The Discrete Event System (DES) used by OPNET is based on event-driven simulation of network events, and the controller, which also uses the DES engine, can be clocked to control events to ensure consistency between the controller and the progress of the simulation scenario. In the network traffic simulation attack scenario, the main nodes that need to be included are the network basic nodes (OpenFlow switch nodes, SDN-Sitl interfaces, and external controllers) and the network attack nodes (hacker nodes and infected machines). In this paper, we mainly model the node layer, process layer and network layer through a three-layer modeling mechanism, respectively. In addition, the deployment of the defense model in a virtual machine is not a modeling consideration in this paper.

Five kinds of DDoS attacks are set up in the simulation test, and the attack strength is gradually increasing from I to V. Using the IMPORT TRAFFIC FLOW module in OPNET and the northbound interface of the SDN controller to collect 1263 DDoS attack traffic and 12,452 normal traffic data alternately, a total of 20 simulation tests. The normal traffic sample category label is set to C0, and the attack traffic sample categories are set to C1, C2, C3, C4, and C5 according to the intensity Ⅰ to Ⅴ, respectively. The detection results of the traffic data in the model simulation experiments are shown in Figure 4. For normal data traffic, the detection accuracy can reach up to 99.99%, and the average accuracy of detection is 97.54%. For attacking abnormal big data traffic, the detection accuracy of five kinds of intensity malicious traffic of C1 (99.09%), C2 (97.02%), C3 (94.94%), C4 (92.20%) and C5 (90.03%) shows a decreasing trend, and it can reach up to 99.86%, and the overall accuracy of abnormal traffic data detection can reach 94.66%. It can be seen that most of the data traffic in the simulation test can be effectively recognized, which verifies the application effectiveness of the traffic recognition model in this paper.

Figure 4.

Online Detection Accuracy

This section verifies the performance improvement of the system by asynchronous updating of the model. First, novel attacks that do not appear in the model training are replayed into the anomaly detection system to test the detection accuracy of the detection entity model for new attacks before and after the update. The experimental results of new traffic attack detection before and after the update are shown in Table 4, and the updated model improves the overall data traffic detection accuracy by 2.69%. Categorically, the detection accuracy is improved from 91.00% to 97.16% for newly injected attack types, and the detection accuracy is improved by 0.71% for normal traffic. In addition to that, from the results, it can be seen that the accuracy of detecting new types of attacks injected before the model update can reach 91.00%, which indicates that the traffic recognition model proposed in this paper has a certain degree of generalization and can detect unknown attacks.