使用XAI優化圖神經網路模型於網路惡意流量偵測之研究;A Study of Malicious Network Traffic Detection Based on Graph Neural Network and Using eXplainable Artificial Intelligence to Optimize Model

NCU Institutional Repository > 資訊電機學院 > 資訊工程研究所 > 博碩士論文 > Item 987654321/89929

請使用永久網址來引用或連結此文件: http://ir.lib.ncu.edu.tw/handle/987654321/89929

題名:	使用XAI優化圖神經網路模型於網路惡意流量偵測之研究;A Study of Malicious Network Traffic Detection Based on Graph Neural Network and Using eXplainable Artificial Intelligence to Optimize Model
作者:	吳晨緯;Wu, Chen-Wei
貢獻者:	資訊工程學系
關鍵詞:	入侵檢測系統;流量分類;圖神經網路;可解釋人工智慧;特徵分析;模型優化;Intrusion Detection System;Traffic Classification;Graph Neural Network;Explainable Artificial Intelligence;Feature Analysis;Optimize Model
日期:	2022-08-11
上傳時間:	2022-10-04 12:05:04 (UTC+8)
出版者:	國立中央大學
摘要:	現今網路技術的多樣化、5G 網路的蓬勃發展以及各式各樣雲端服務的出現，促使智慧型手機、智慧型穿戴裝置及物聯網（Internet of Thing）設備的數量大量的成長，使網路攻擊（Cyberattack）防護的重要性隨之提高。在一般的入侵檢測系統（Intrusion Detection System）上，流量檢測方式只有使用到網路中兩個節點之間的流量資訊，但是在整個網路中是同時的有大量的流量在傳遞，使用一般的方法並無法使用到網路中多個節點的流量資訊。將網路流量轉換為圖（Graph）的方式，可以利用到整個網路中更多的流量資訊，但同時在有如此豐富的資料上，要如何有效的去使用以及計算如此龐大的資料將會是一個挑戰。本論文為了解決在一般入侵檢測系統只使用到兩節點之流量問題，提出一個專門用於邊特徵的圖神經網路演算法 EdgeSAGE（Edge SAmple and aggreGatE），並用其建立惡意流量分類模型，透過將流量轉換為圖並利用圖的結構性將流量特徵進行傳遞與聚合，使流量在預測時可以有效的使用到鄰近的流量資訊，讓模型在攻擊流量的分類上變得更加準確。此外使用XAI（eXplainable Artificial Intelligence）技術去分析模型的輸入特徵，計算出每個特徵對於模型的重要性，並利用分析結果降低模型輸入之維度同時減少模型中的參數，以達到降低模型計算成本之優化效果。使用EdgeSAGE相較於相同架構的DNN模型F1-Score可以提升15.48%，在EdgeSAGE模型優化結果上可以在幾乎不影響模型準確度的情況下，降低12.9%的預測時間與提升14.8%的Throughput，另外在降低 36.1% 的預測時間和提升 57.2% 的 Throughput 的情況下，EdgeSAGE模型仍可保有 92.4 %的F1-Score。 ;The diversification of today′s network technologies, the vigorous development of 5G networks, and the emergence of various cloud services have led to massive growth in the number of smartphones, smart wearable devices, and Internet of Things (Internet of Things) devices. The importance of cyberattack protection has increased accordingly. In general intrusion detection systems, the traffic detection method only uses the traffic information between two nodes in the network, but a large amount of traffic is transmitted simultaneously in the entire network. Traffic information to multiple nodes in the network is not available using general methods. The way of converting network traffic into graph can utilize more traffic information in the entire network, but at the same time, with such abundant data, how to effectively use and calculate such huge data will be a challenge. To solve the problem that only two nodes are used in general intrusion detection systems, this paper proposes a graph neural network algorithm EdgeSAGE (Edge SAmple and aggreGatE) specially used for edge features. And use it to build a malicious traffic classification model. By converting traffic into a graph and using the structure of the graph to transmit and aggregate traffic features, the adjacent traffic information can be effectively utilized in traffic prediction, and the model can be used in the classification of attack traffic to become more accurate. In addition, XAI (eXplainable Artificial Intelligence) technology is used to analyze the input features of the model, calculate the importance of each feature to the model, and use the analysis results to reduce the dimension of the model input and reduce the parameters in the model. To achieve the effect of optimizing the model and reducing the calculation cost. Compared with the DNN model of the same architecture, the F1-Score of EdgeSAGE can be improved by 15.48%. The optimization results of EdgeSAGE model can reduce the prediction time by 12.9% and improve the throughput by 14.8% with hardly change in the accuracy of the model. With a 36.1% reduction in prediction time and a 57.2% improvement in throughput, the EdgeSAGE model still retains a 92.4% F1-Score.
顯示於類別:	[資訊工程研究所] 博碩士論文

文件中的檔案:

檔案	描述	大小	格式	瀏覽次數
index.html		0Kb	HTML	24	檢視/開啟

在NCUIR中所有的資料項目都受到原著作權保護.

社群 sharing

資料載入中.....