| 摘要: | 近年來隨著網路技術的蓬勃發展，網路已經深深地融入了我們的生活。然而隨著洋蔥路由器（The onion router，Tor）和虛擬私人網路（Virtual Private Network，VPN）等技術的出現，暗網逐漸形成。為了有效的抵禦暗網的活動，會使用機器學習或深度學習技術在入侵檢測系統（Intrusion Detection System,IDS）上來偵測惡意流量，由於模型超參數空間的複雜性與輸入資料的特徵數量眾多，若依人工方式去手動調整超參數以及進行特徵選擇，將導致高昂的嘗試成本，如何有效的替模型尋找一個較佳的模型超參數與適合的特徵子集合將是一個挑戰。
本論文為了替模型尋找一個較佳的超參數配置並且減少模型的輸入特徵，提出Particle Swarm Optimization - eXtreme Gradient Boosting（PSO-XGB）方法用於建立暗網流量分類模型，該方法利用粒子群演算法替XGBoost模型尋找模型的最佳超參數配置，進而優化模型準確度，並且替輸入資料進行特徵選擇，粒子可以將特徵收斂到較優的特徵子集合以降低模型預測時間，本論文在CIC-Darknet2020資料集的實驗結果中，於Layer-1暗網流量類型分類有著98.42%的F1-score，可以將特徵數量由81個減少至43個，並減少23.52%的預測時間；在Layer-2流量的服務應用類型分類有91.28%的F1-score，可以將特徵數量由81個減少至43個，並減少9.27%的預測時間。PSO-XGB在兩個Layer上相較於Bagging、Random Forest以及CNN都有著更高的準確度，相比手動設超參數的XGBoost模型分別可以提升5.2%與6.78%的F1-score，雖然本論文提出之方法能有效提升模型準確度，但須於模型訓練階段花費較多的訓練時間，因此模型的準確度與訓練時間兩者將需要根據需求做出取捨。
;In recent years, with the rapid development of internet technology, the internet has deeply integrated into our lives. However, with the emergence of technologies such as The Onion Router (Tor) and Virtual Private Network (VPN), the darknet has gradually formed. To effectively counter the activities on the dark web, machine learning or deep learning techniques are used in Intrusion Detection System (IDS) to detect malicious traffic. Due to the complexity of the model′s hyperparameter space and the large number of input data features, manually adjusting the hyperparameters and performing feature selection would lead to high trial costs. Finding a better set of model hyperparameters and suitable feature subsets for the model effectively will be a challenge.
We propose Particle Swarm Optimization - eXtreme Gradient Boosting（PSO-XGB）method for building a darknet traffic classification model, aiming to find better hyperparameter configurations for the model and reduce the input features. The method utilizes the Particle Swarm Optimization algorithm to search for the optimal hyperparameter configuration for the XGBoost model, thereby optimizing the model′s accuracy. It also performs feature selection on the input data, allowing the particles to converge on a superior subset of features to reduce the model′s prediction time.In the experiments conducted on the CIC-Darknet2020 dataset, this paper achieves an F1-score of 98.42% for the classification of Layer-1 darknet traffic types, reducing the number of features from 81 to 43 and decreasing the prediction time by 23.52%. For the classification of Layer-2 traffic service applications, an F1-score of 91.28% is obtained, reducing the number of features from 81 to 43 and decreasing the prediction time by 9.27%.PSO-XGB outperforms Bagging, Random Forest, and CNN in terms of accuracy on both layers. Compared to manually setting hyperparameters for the XGBoost model, PSO-XGB achieves an improvement of 5.2% and 5.78% in F1-score, respectively. Although the proposed method effectively improves the model′s accuracy, it requires more training time during the model training phase. Therefore, the trade-off between model accuracy and training time needs to be considered based on specific requirements. |
