Currently, there are several issues with predicting the situational awareness log traffic of various security devices monitored within the security service networks of operators and internet enterprises. Firstly, most existing prediction models lack the capability to extract spatio-temporal global information from message sequences and tend to have a high proportion of ineffective feature information. Secondly, in the actual production network environment, there is a strong trend correlation between the first-order differences of situational alarm log traffic of each device at consecutive time points and the network delay volatility of each device’s received logs. However, most existing traffic prediction methods fail to consider this aspect, resulting in lower prediction accuracy of network situational traffic. To address these issues, an improved spatio-temporal transform network model introducing Volatility Evaluation (VE-STTN) is proposed for predicting situational log traffic and handling data. The VE-STTN model not only introduces a dynamic pooling layer into the existing STTN network, reducing the extraction of ineffective features from log traffic data in spatio-temporal features and achieving key information aggregation but also enhancing the model’s learning performance. Particularly noteworthy is the innovative introduction of the Generalized Autoregressive Conditional Heteroskedasticity (GARCH) model data processing module in the VE-STTN model to calculate the forecasted future delay volatility from the improved STTN predictions and use it to optimize and adjust the predicted situational traffic results. Experimental results demonstrate that this approach improves prediction accuracy and robustness
Domain Name System (DNS) service is a core service on the Internet and a key link to ensure the normal operation of the Internet. Since DNS can often pass through firewalls without being intercepted, it creates favorable conditions for attackers to build a covert channel based on the DNS protocol. DNS over HTTPS (DoH) can encrypt DNS lookup and response data packets to ensure that data packets are not monitored and used, but it also makes the DNS tunnels more difficult to detect. Due to the security of DoH, researchers began trying to detect DoH tunnels by using machine or deep learning. The effect of the model is not good if the data quality is poor or the amount of data is insufficient. Due to the privacy of traffic data, it is usually difficult to collect and share private traffic data to a centralized server. We propose a federated-learning DoH traffic classification framework (FL_DoH_CF), which permits multiple institutions to detect DoH tunnels by using convolutional neural network (CNN) without sharing traffic data. The experiments demonstrate that FL_DoH_CF is competitive with centralized learning, and it is still robust for non-independent and identically distributed (No_IID) data, and even achieves an accuracy of 99.86% for extreme one-class No_IID data.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.