PCCN: Parallel Cross Convolutional Neural Network for Abnormal Network Traffic Flows Detection in Multi-Class Imbalanced Network Traffic Flows

Abstract

Network attack behavior detection using deep learning is an important research topic in the field of network security. Currently, there are still many challenges in detecting multi-class imbalanced abnormal traffic data. This paper proposed a new intrusion detection network based on deep learning, named parallel cross convolutional neural network (PCCN), to improve the detection performance of imbalanced abnormal flows. By fusing the flow features learned from the two branch convolutional neural networks (CNN), PCCN can better learn the flow features with fewer samples, to improve the detection results of the imbalanced abnormal flows. We proposed an improved feature extraction method of the original flow to extract multi-class flow features at the same time. The proposed algorithm not only reduces the number of useless elements for network learning, but also accelerates network convergence. In addition, we proposed four improved versions of the PCCN network structure to meet the real-time requirements of network intrusion detection in the current big data computing. These networks can achieve almost the same detection results as the PCCN, but greatly reduce the detection time of data. Through the analysis of high-order evaluation metrics, the proposed PCCN algorithm is significantly better than the traditional machine learning algorithms. Compared with the current hierarchical network model, PCCN can also achieve better performance in term of overall accuracy.