基于深度多实例学习的网络异常流量检测

doi:10.11896/jsjkx.250600041

Abstract

Abstract: With the exponential growth of network scale and the increasing complexity of traffic patterns,traditional anomaly traffic detection methods based on individual traffic samples face serious challenges in terms of real-time performance and computational efficiency.To address this issue,this study proposes a deep multi-instance learning framework with a gated attention mechanism,named GAD-MIL.This framework processes traffic samples in bags,replacing traditional instance-level analysis with bag-level analysis and anomaly localization to achieve efficient abnormal traffic detection.Specifically,for the bagged traffic data,the proposed method adopts a two-stage learning architecture.Firstly,a pre-trained feature extractor is used to generate discriminative traffic embeddings.Secondly,a gated attention-based multi-instance pooling layer is introduced to dynamically aggregate instance features within each bag and identify anomalous samples.This architecture overcomes traditional MIL models’ reliance on bag-level labels,enabling end-to-end instance-level anomaly localization while maintaining low computational complexity.Experimental results on five benchmark datasets such as CICIDS2017 and DoH2020 show that,GAD-MIL significantly reduces in-ference time and achieves a 2.72 percentage-point improvement in F1 score over traditional deep learning methods on the CICIDS2017 dataset and a 4.2× speedup in computational efficiency.

Key words: Network anomaly traffic detection, Multi-instance learning, Attention mechanism, Inference efficiency, Feature extraction

CLC Number:

TP183

FENG Haoyu, ZHANG Yuxuan, LIU Zixuan, MENG Hua. Network Anomaly Traffic Detection Based on Deep Multi-instance Learning[J].Computer Science, 2026, 53(8): 426-436.

References

[1] KWON D,KIM H,KIM J,et al.A survey of deep learning-based network anomaly detection[J].Cluster Computing,2019,22:949-961.
[2] WANG W,ZHU M,ZENG X,et al.Malware traffic classification using convolutional neural network for representation learning[C]//2017 International Conference on Information Networking(ICOIN).New York,USA:IEEE Press,2017:712-717.
[3] DING H,SUN Y,HUANG N,et al.TMG-GAN:Generative adversarial networks-based imbalanced learning for network intrusion detection[J].IEEE Transactions on Information Forensics and Security,2023,19:1156-1167.
[4] DUAN X,FU Y,WANG K.Network traffic anomaly detection method based on multi-scale residual classifier[J].Computer Communications,2023,198:206-216.
[5] ZHOU Z H.Multi-instance learning:A survey[R].Department of Computer Science & Technology,Nanjing University,2004:4.
[6] JIANG X,ZHANG H R,ZHOU Y.Multi-granularity abnormal traffic detection based on multi-instance learning[J].IEEE Transactions on Network and Service Management,2023,21(2):1467-1477.
[7] ZHANG J,HAN D,LV Z,et al.Bag2image:a multi-instancenetwork traffic representation for network security event prediction[J].Cybersecurity,2025,8(1):31.
[8] KIM M S,KONG H J,HONG S C,et al.A flow-based method for abnormal network traffic detection[C]//2004 IEEE/IFIP Network Operations and Management Symposium(IEEE Cat.No.04CH37507).New York,USA:IEEE Press,2004:599-612.
[9] FINSTERBUSCH M,RICHTER C,ROCHA E,et al.A survey of payload-based traffic classification approaches[J].IEEE Communications Surveys & Tutorials,2013,16(2):1135-1156.
[10] FAN Z,LIU R.Investigation of machine learning based network traffic classification[C]//2017 International Symposium on Wireless Communication Systems(ISWCS).New York,USA:IEEE Press,2017:1-6.
[11] YANG J,NARANTUYA J,LIM H.Bayesian neural networkbased encrypted traffic classification using initial handshake packets[C]//2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks-Supplemental Volume(DSN-S).Los Alamitos,USA:IEEE Press,2019:19-20.
[12] MA Q,SUN C,CUI B,et al.A novel model for anomaly detection in network traffic based on kernel support vector machine[J].Computers & Security,2021,104:102215.
[13] WU T,FAN H,ZHU H,et al.Intrusion detection system combined enhanced random forest with SMOTE algorithm[J].EURASIP Journal on Advances in Signal Processing,2022,2022(1):39.
[14] LU C,CAO Y,WANG Z.Research on intrusion detection based on an enhanced random forest algorithm[J].Applied Sciences,2024,14(2):714.
[15] CHEN Y.Convolutional neural network for sentence classification[D].Waterloo,Canada:University of Waterloo,2015.
[16] LUO H,WAN L.A Network Traffic Intrusion Detection Method Based on Dynamic Spatio-Temporal Graph Neural Network[J].Computer Engineering,doi:10.19678/j.issn.1000-3428.0070520.
[17] GRAVES A,SCHMIDHUBER J.Framewise phoneme classification with bidirectional LSTM and other neural network architectures[J].Neural Networks,2005,18(5/6):602-610.
[18] ZHU Z,LIANG D,ZHANG S,et al.Traffic-sign detection and classification in the wild[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition.New York,USA:IEEE Press,2016:2110-2118.
[19] GOODFELLOW I,POUGET-ABADIE J,MIRZA M,et al.Gene-rative adversarial networks[J].Communications of the ACM,2020,63(11):139-144.
[20] GAO Z Y,WANG T J,WANG Y,et al.Traffic PredictionMethod for 5G Network Based on Generative Adversarial Network[J].Computer Science,2022,49(4):321-328.
[21] VASWANI A,SHAZEER N,PARMAR N,et al.Attention is all you need[J].Advances in Neural Information Processing Systems,2017,30.
[22] SHI L,ZHANG J T,GAO Y F,et al.Intrusion Detection of Network Traffic based on Transformer and BiLSTM[J].Computer Engineering,2023,49(3):29-36;57.
[23] DIETTERICH T G,LATHROP R H,LOZANO-PÉREZ T.Solving the multiple instance problem with axis-parallel rectangles[J].Artificial Intelligence,1997,89(1/2):31-71.
[24] ZHANG M L,ZHOU Z H.Multi-instance clustering with applications to multi-instance prediction[J].Applied Intelligence,2009,31:47-68.
[25] WEI X S,WU J,ZHOU Z H.Scalable multi-instance learning[C]//2014 IEEE International Conference on Data Mining.New York,USA:IEEE Press,2014:1037-1042.
[26] WEI X S,WU J,ZHOU Z H.Scalable algorithms for multi-instance learning[J].IEEE Transactions on Neural Networks and Learning Systems,2016,28(4):975-987.
[27] WU J,PAN S,ZHU X,et al.Multi-instance learning with dis-criminative bag mapping[J].IEEE Transactions on Knowledge and Data Engineering,2018,30(6):1065-1080.
[28] XU B C,TING K M,ZHOU Z H.Isolation set-kernel and its application to multi-instance learning[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining.New York,USA:ACM,2019:941-949.
[29] XIAO Y,LIU B,HAO Z.Multi-Instance Nonparallel TubeLearning[J].IEEE Transactions on Neural Networks and Learning Systems,2024,36:2563-2577.
[30] ILSE M,TOMCZAK J,WELLING M.Attention-based deepmultiple instance learning[C]//International Conference on Machine Learning.San Diego,USA:PMLR,2018:2127-2136.
[31] SHI X,XING F,XIE Y,et al.Loss-based attention for deepmultiple instance learning[C]//Proceedings of the AAAI Conference on Artificial Intelligence.Palo Alto,USA:AAAI Press,2020:5742-5749.
[32] SHAO Z,BIAN H,CHEN Y,et al.Transmil:Transformerbased correlated multiple instance learning for whole slide image classification[J].Advances in Neural Information Processing Systems,2021,34:2136-2147.
[33] ZHANG W,ZHANG X,ZHANG M L.Multi-instance causalrepresentation learning for instance label prediction and out-of-distribution generalization[J].Advances in Neural Information Processing Systems,2022,35:34940-34953.
[34] SHARAFALDIN I,LASHKARI A H,GHORBANIA A.To-ward generating a new intrusion detection dataset and intrusion traffic characterization[J].ICISSP,2018,1(2018):108-116.
[35] MONTAZERISHATOORI M,DAVIDSON L,KAUR G,et al.Detection of doh tunnels using time-series classification of encrypted traffic[C]//2020 IEEE Intl Conf on Dependable,Autonomic and Secure Computing,Intl Conf on Pervasive Intelligence and Computing,Intl Conf on Cloud and Big Data Computing,Intl Conf on Cyber Science and Technology Congress(DASC/PiCom/CBDCom/CyberSciTech).Los Alamitos,USA:IEEE Press,2020:63-70.
[36] MOUSTAFA N,SLAY J.UNSW-NB15:a comprehensive dataset for network intrusion detection systems(UNSW-NB15 network data set)[C]//2015 Military Communications and Information Systems Conference(MilCIS).New York,USA:IEEE Press,2015:1-6.
[37] SIDDIQUI M K,NAAHID S.Analysis of KDD CUP 99 dataset using clustering based data mining[J].International Journal of Database Theory and Application,2013,6(5):23-34.
[38] KONSTANTINOV A V,UTKIN L V.Multi-attention multiple instance learning[J].Neural Computing and Applications,2022,34(16):14029-14051.

Related Articles 15

[1]	LIU Yanze, HAN Bo, YUAN Jidong, SU Dongliang, REN Jia, CAI Zhiming, WANG Zhihai. Anomaly Detection in Time Series Based on Time-Frequency Contrastive Learning [J]. Computer Science, 2026, 53(8): 20-28.
[2]	ZHANG Xueyi, YAN Feifei. Deep Forest Models Based on CNN Feature Enhancement and Dynamic Sparse Cascading [J]. Computer Science, 2026, 53(8): 61-70.
[3]	YANG Chenguang, LU Jicang, GUO Jiaxing. Fake News Detection Model Based on Cross-modal Feature Fusion and Alignment [J]. Computer Science, 2026, 53(8): 257-265.
[4]	JIANG Lingla, CHEN Wen, SUN Wei, ZHAO Kui. Research on Deep Learning-based Side-channel Analysis Method with Dynamically ComposableMulti-head Attention [J]. Computer Science, 2026, 53(8): 437-445.
[5]	ZHU Bin, LI Xiaobin. AETC:Image Classification Model via Attention-based Topological Features Fusion [J]. Computer Science, 2026, 53(7): 24-33.
[6]	ZHANG Yan, ZHOU Jian, HAN Lei, CHENG Chunling. Gate-controlled Agent Attention Mechanism-based Soft Prompt Transfer Method [J]. Computer Science, 2026, 53(7): 139-145.
[7]	DING Zhijun, AI Fangju, LIU Aihuan. Document-level Event Argument Extraction Model Based on Hierarchical Dependency Aggregation and Event Enhancement [J]. Computer Science, 2026, 53(7): 156-167.
[8]	LI Kaiju, YIN Chenyang, CHENG Zhangtao, LIU Xueting, ZHOU Fan. Causal Subgraph Learning for Cascade Popularity Prediction [J]. Computer Science, 2026, 53(7): 213-221.
[9]	XIAO Yanxue, DENG Li, REN Zhengwei, WU Mengxin. iDSRformer:Node Load Prediction Model for High-performance Computing Cluster [J]. Computer Science, 2026, 53(7): 251-261.
[10]	YAO Ye, GUO Kangning, ZHU Yian, LIAO Shaochun, ZHANG Ni. Research on Health Evaluation Technology of AHP-FEC Meteorological Equipment Based onLasso Optimization [J]. Computer Science, 2026, 53(6A): 250400123-16.
[11]	WEI Wei, LI Bicheng, ZHU Zhenshui, ZUO Jun. Semantic Modeling and Co-attention Mechanism for Multimodal Sarcasm Detection Method [J]. Computer Science, 2026, 53(6A): 250400127-6.
[12]	FENG Guang, LIN Jianzhong, ZHONG Ting, ZHOU Yuanhua, ZHENG Runting, LIU Tianxiang. Triple Extraction Based on Pixel Difference Convolutional Network and Attention Mechanism [J]. Computer Science, 2026, 53(6A): 250400136-10.
[13]	CHEN Dianlong, LIU Tengbin, GAO Xiong, TIAN Zijian, ZHU Wenbing, ZOU Shun, WANG Qiang. Defect Detection of Transmission Line Fittings Based on Multiscale Feature Fusion Attention and Cross-layer Aggregation [J]. Computer Science, 2026, 53(6A): 250600110-7.
[14]	SHEN Yingchun, FENG Xiaohan, LI Qian. Accurate Recognition of Dialect Based on CTC-Conformer Model [J]. Computer Science, 2026, 53(6A): 250600112-8.
[15]	ZHONG Hao, KONG Qingxuan, CAI Xianqing, LI Zhizhong, SUN Hao. Intelligent Recognition Method Based on Multimodal Feature Fusion [J]. Computer Science, 2026, 53(6A): 250700065-10.

Metrics

Viewed

Full text

Abstract

Cited

Shared

Discussed

Comments

Recommended 0

No Suggested Reading articles found!

Network Anomaly Traffic Detection Based on Deep Multi-instance Learning

PDF (PC)

Abstract

Cite this article

share this article

References

Related Articles 15

Metrics

Comments

Recommended 0