基于多域融合和交叉注意力的短拍网络入侵检测方法
Congyuan Xu1,2, Donghui Li1, Zihao Liu1,2
1School of Electrical and Information Engineering, Tianjin University, Tianjin, China.
PloS one
|July 2, 2025
概括
这项研究引入了一种使用多域特征融合和交叉注意力的新一代短拍网络入侵检测方法. 这种方法在现实场景中显著提高了准确性和稳定性,数据有限,领域转移.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 网络安全 网络安全
背景情况:
- 深度学习在网络入侵检测方面表现出色,但在现实应用中,它在有限的攻击样本和域移动方面遇到了困难.
- 现有的方法往往无法在不同的网络环境中有效地泛化,或者当训练数据稀缺时.
- 解决这些局限性对于强大可靠的网络安全至关重要.
研究的目的:
- 提出一种新的少数拍摄网络入侵检测方法,克服数据稀缺和域转移的局限性.
- 加强跨不同领域的网络流量特征的可区分性和融合.
- 提高入侵检测系统在动态环境中的稳定性和实用性.
主要方法:
- 一个双分支特征提取器,捕获网络流量的空间和频域特征 (使用2D-DCT).
- 一个双域双向交叉注意模块,用于在少数镜头条件下对准支持和查询样本之间的特征.
- 一个分层的特征编码模块,利用修改的Mamba架构来实现远程依赖和时间模式捕获.
主要成果:
- 在10次拍摄设置中,CICIDS2017和CICIDS2018数据集的准确度达到99.03%和98.64%,超过了最先进的方法.
- 证明了强大的跨域概括,在跨域场景中准确度超过95.13%.
- 拟议的方法显示了在少数镜头学习和域调整中显著的改进,用于网络入侵检测.
结论:
- 这种新的少数拍摄入侵检测方法有效地处理有限的数据和域移动.
- 多域特征融合和交叉注意力的集成显著提高了检测性能和概括性.
- 该方法为现实世界的网络安全挑战提供了强大而实用的解决方案.
相关概念视频
01:21Association Areas of the Cortex
6.3K
Association areas are regions of the cerebral cortex that do not have a specific sensory or motor function. Instead, they integrate and interpret information from various sources to enable higher cognitive processes such as memory, learning, and decision-making. Some key association areas include the following:
Prefrontal Association Area: This area is located in the frontal lobe and is involved in planning, decision-making, and moderating social behavior. It connects with primary motor areas,...
Prefrontal Association Area: This area is located in the frontal lobe and is involved in planning, decision-making, and moderating social behavior. It connects with primary motor areas,...
6.3K
01:05Collisions in Multiple Dimensions: Introduction
5.6K
It is far more common for collisions to occur in two dimensions; that is, the initial velocity vectors are neither parallel nor antiparallel to each other. Let's see what complications arise from this. The first idea is that momentum is a vector. Like all vectors, it can be expressed as a sum of perpendicular components (usually, though not always, an x-component and a y-component, and a z-component if necessary). Thus, when the statement of conservation of momentum is written for a...
5.6K
01:19Masking and Demasking Agents
2.7K
EDTA titrations may necessitate masking and demasking agents to temporarily protect a particular metal ion in a mixture from the EDTA reaction. These agents facilitate the sequential analysis of the metal ions by forming stable complexes with some—but not all—metal ions during certain steps.
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
2.7K
01:05Difference from Background: Limit of Detection
7.1K
The limit of detection (LOD) is the smallest amount of analyte that can be distinguished from the background noise. The LOD value corresponds to the concentration at which the analyte signal is three times larger than the standard deviation of the blank signal. Below this value, the analyte signal cannot be differentiated from the background noise. It is calculated by dividing the calibration slope by 3 times the standard deviation of the blank signals.
The LOD indicates the presence or absence...
The LOD indicates the presence or absence...
7.1K