運用XAI於輕量CNN模型於惡意流量時頻影像分類

以作者查詢圖書館館藏

、以作者查詢臺灣博碩士

、以作者查詢全國書目

、勘誤回報

、線上人數：69

、訪客IP：18.225.156.91

姓名

蕭翼遠(Yi-Yuan Hsiao) 查詢紙本館藏

畢業系所

資訊工程學系在職專班

論文名稱

運用XAI於輕量CNN模型於惡意流量時頻影像分類
(A Malicious Traffic Spectrogram Image Classification Based on Lightweight CNN Using XAI)

相關論文

★ 無線行動隨意網路上穩定品質服務路由機制之研究	★ 應用多重移動式代理人之網路管理系統
★ 應用移動式代理人之網路協同防衛系統	★ 鏈路狀態資訊不確定下QoS路由之研究
★ 以訊務觀察法改善光突發交換技術之路徑建立效能	★ 感測網路與競局理論應用於舒適性空調之研究
★ 以搜尋樹為基礎之無線感測網路繞徑演算法	★ 基於無線感測網路之行動裝置輕型定位系統
★ 多媒體導覽玩具車	★ 以Smart Floor為基礎之導覽玩具車
★ 行動社群網路服務管理系統－應用於發展遲緩兒家庭	★ 具位置感知之穿戴式行動廣告系統
★ 調適性車載廣播	★ 車載網路上具預警能力之車輛碰撞避免機制
★ 應用於無線車載網路上之合作式交通資訊傳播機制以改善車輛擁塞	★ 智慧都市中應用車載網路以改善壅塞之調適性虛擬交通號誌

檔案

[Endnote RIS 格式]

[Bibtex 格式]

[相關文章]

[文章引用]

[完整記錄]

[館藏目錄]

至系統瀏覽論文 ( 永不開放)

摘要(中)

在科技的日新月異下，網路逐漸跟這個世界密不可分，聯網裝置數量也以驚人的速度增加，但同時這也成為網路攻擊者的目標。各個領域隨著人工智能模型（Artificial Intelligence Model, AI 模型）的興起都往前邁進一大步，其中也包括網路防禦。然而攻擊者對於網路攻擊手法的不斷更新，在攻擊手法多樣下，攻擊資料分析將會以時域（time）與頻率域（frequency）兩大資料型態呈現。AI模型開發者通常擇一資料型態進行模型開發，然而近年AI模型開發者為帶來更好地模型效能通常以改變模型架構，而非模型計算策略優化，使AI模型需使用較高運算能力。在智能生活的驅使下，低運算能力的聯網裝置急速成長，攻擊者也將目標放置此類防禦較低的裝置上，因此能夠同時擁有兩種資料特性、輕量化與人工智能模型的解析將是未來網路攻擊的防禦部署與模型優化的重要關鍵。
本篇論文使用時頻圖（Spectrogram）將時域與頻率域特性的資料同時帶入人工智能模型中，為了解決低運算能力裝置的防禦部署問題，提出輕量化模型Light Weight Gray Spectrogram Convolution Neural Network（LGS-CNN）和1DG-Spectrogram Convolution Neural Network（1DGS-CNN），並使用可解釋AI (Explainable AI, XAI）進行模型解釋。可以有效地分類公開資料集中7種攻擊類型，並且分別達到98.86%和98.79%的準確率，與SDCNN模型比較下每秒浮點數計算量分別低於12.14%和96.57%，並在XAI與實驗特徵解釋下，可以確保模型所使用特徵數量在76時可以達到模型最優的狀態。結果顯示本篇論文所提出之輕量化卷積神經網路與XAI之特徵影像惡意流量偵測是可以有效減輕系統運算量並確保使用特徵數量上擁有最優的準確度與F1-Score。

摘要(英)

As technology improves every day, the internet is becoming inseparable with world and the number of connected devices growing rapidly. Also, the connected devices become target for cyber attacker. The rise of artificial intelligence models (AI models) has taken a big step forward in every field, including cyber defense. However, attackers are constantly updating network attack methods. Under the various attack methods, the analysis of attack data will be presented in two data characteristics, time domain and frequency domain. AI model developers usually choose a data type for model development. However, in recent years, AI model developers usually change the model structure to bring better model performance, rather than optimizing the model calculation strategy, so that AI models need to use higher computing power. Driven by intelligent life, networked devices with low computing power are rapidly growing, and attackers also target such devices with low defense. Therefore, the ability to have two data characteristics at the same time, lightweight and artificial intelligence model analysis will be the key to defense deployment and model optimization of future cyber attacks.
This paper, Spectrogram is used to bring the data of time domain and frequency domain characteristics into the artificial intelligence model at the same time. In order to solve the problem of defense deployment of low computing devices, a Light Weight Gray Spectrogram Convolution Neural Network( LGS-CNN) and 1DG-Spectrogram Convolution Neural Network (1DGS-CNN) are proposed, and use Explainable AI (Explainable AI, XAI) for model parsing. It can effectively classify 7 attack types in the public data set, and achieve 98.86% and 98.79% accuracy respectively. Compared with the SDCNN model, the floating-point calculation per second is lower than 12.14% and 96.57%, respectively. Under the feature analysis, it can be ensured that the number of features used by the model can reach the optimal state of the model when the number of features is 76. The results show that the lightweight convolutional neural network and XAI feature image malicious traffic detection proposed in this paper can effectively reduce the system burden and ensure the optimal performance in terms of the number of features used.

關鍵字(中)

★ 卷積神經網路
★ 時頻圖
★ 輕量化
★ 可解釋AI

關鍵字(英)

★ CNN
★ Spectrogram
★ Lightweight
★ XAI

論文目次

摘要i
Abstractii
誌謝iv
目錄v
圖目錄vii
表目錄ix
第一章緒論1
1.1.概要1
1.2.研究動機2
1.3.研究目的3
1.4.章節架構4
第二章背景知識與相關研究5
2.1.流量分類方法5
2.2.時頻圖（Spectrogram）7
2.3.卷積神經網路（Convolutional Neural Network, CNN）9
2.4.可解釋AI（explainable artificial intelligence, XAI）12
2.5.效能評估與相關文獻13
2.5.1.相關文獻14
2.5.2.效能評估指標16
第三章研究方法18
3.1.設計概念18
3.2.系統架構22
3.2.1.資料前處理24
3.2.2.模型架構32
3.2.3.分析模組36
第四章實驗與討論40
4.1.實驗環境40
4.2.情境一 : 攻擊流量分類成效與影像強化效果41
4.2.1.實驗一 : RGB vs Gray42
4.2.2.實驗二 : 攻擊流量分類43
4.2.3.實驗三 : 影像強化44
4.3.情境二 : 效能與輕量化指標比較46
4.3.1.實驗四 : 效能比較47
4.3.2.實驗五 : 輕量化指標比較49
4.4.情境三 : 特徵篩選51
4.4.1.實驗六 : 特徵篩選實驗52
4.4.2.實驗七 : XAI特徵篩選實驗56
第五章結論與未來研究方向58
5.1.結論58
5.2.研究限制59
5.3.未來研究59
參考文獻62

參考文獻

Electronic Markets, vol. 31, no. 3, pp. 685-695, 2021.
[2] A. S. Khan, Z. Ahmad, J. Abdullah, and F. Ahmad, "A spectrogram image-based network anomaly detection system using deep convolutional neural network," IEEE Access, vol. 9, pp. 87079-87093, 2021.
[3] U. Cisco, "Cisco annual internet report (2018–2023) white paper," Cisco: San Jose, CA, USA, 2020.
[4] T. M. Research. "TREND MICRO SECURITY PREDICTIONS FOR 2022." https://documents.trendmicro.com/assets/rpt/rpt-toward-a-new-momentum-trend-micro-security-predictions-for-2022.pdf (accessed.
[5] D. H. Dario Amodei, Girish SastryJack, ClarkGreg Brockman,Ilya Sutskever. "AI and Compute." OpenAI. https://openai.com/blog/ai-and-compute/ (accessed.
[6] A. Adadi and M. Berrada, "Peeking inside the black-box: a survey on explainable artificial intelligence (XAI)," IEEE access, vol. 6, pp. 52138-52160, 2018.
[7] J. W. Oh and J. Jeong, "Data augmentation for bearing fault detection with a light weight CNN," Procedia Computer Science, vol. 175, pp. 72-79, 2020.
[8] J. Zhao, X. Jing, Z. Yan, and W. Pedrycz, "Network traffic classification for data fusion: A survey," Information Fusion, vol. 72, pp. 22-47, 2021.
[9] 彭筱茵, "基於卷積神經網路與梯度提升演算法於網路惡意加密流量偵測之研究," 碩士論文, 國立中央大學資訊工程學系, 2021. [Online]. Available: https://hdl.handle.net/11296/4s243p
[10] M. Lopez-Martin, B. Carro, A. Sanchez-Esguevillas, and J. Lloret, "Network traffic classifier with convolutional and recurrent neural networks for Internet of Things," IEEE access, vol. 5, pp. 18042-18050, 2017.
[11] L. Vokorokos and A. Baláž, "Host-based intrusion detection system," in 2010 IEEE 14th International Conference on Intelligent Engineering Systems, 2010: IEEE, pp. 43-47.
[12] M. Liu, Z. Xue, X. Xu, C. Zhong, and J. Chen, "Host-based intrusion detection system with system calls: Review and future trends," ACM Computing Surveys (CSUR), vol. 51, no. 5, pp. 1-36, 2018.
[13] c. Wikipedia, "Spectrogram," in Wikipedia, The Free Encyclopedia., ed.
[14] A. Satt, S. Rozenberg, and R. Hoory, "Efficient Emotion Recognition from Speech Using Deep Learning on Spectrograms," in Interspeech, 2017, pp. 1089-1093.
[15] J. Huang, B. Chen, B. Yao, and W. He, "ECG arrhythmia classification using STFT-based spectrogram and convolutional neural network," IEEE access, vol. 7, pp. 92871-92880, 2019.
[16] L. Chen, S. Li, Q. Bai, J. Yang, S. Jiang, and Y. Miao, "Review of image classification algorithms based on convolutional neural networks," Remote Sensing, vol. 13, no. 22, p. 4712, 2021.
[17] H. Liu, B. Lang, M. Liu, and H. Yan, "CNN and RNN based payload classification methods for attack detection," Knowledge-Based Systems, vol. 163, pp. 332-341, 2019.
[18] S. Albawi, T. A. Mohammed, and S. Al-Zawi, "Understanding of a convolutional neural network," in 2017 international conference on engineering and technology (ICET), 2017: Ieee, pp. 1-6.
[19] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, "Grad-cam: Visual explanations from deep networks via gradient-based localization," in Proceedings of the IEEE international conference on computer vision, 2017, pp. 618-626.
[20] B. Zhou, A. Khosla, A. Lapedriza, A. Oliva, and A. Torralba, "Learning deep features for discriminative localization," in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 2921-2929.
[21] J. Toldinas, A. Venčkauskas, R. Damaševičius, Š. Grigaliūnas, N. Morkevičius, and E. Baranauskas, "A novel approach for network intrusion detection using multistage deep learning image recognition," Electronics, vol. 10, no. 15, p. 1854, 2021.
[22] B. Andreas, J. Dilruksha, and E. McCandless, "Flow-Based and Packet-Based Intrusion Detection Using BLSTM," SMU Data Science Review, vol. 3, no. 3, p. 8, 2020.
[23] M. Wieczorek, J. Siłka, M. Woźniak, S. Garg, and M. M. Hassan, "Lightweight Convolutional Neural Network Model for Human Face Detection in Risk Situations," IEEE Transactions on Industrial Informatics, vol. 18, no. 7, pp. 4820-4829, 2021.
[24] P. Zhao, K. Liu, H. Zou, and X. Zhen, "Multi-stream convolutional neural network for SAR automatic target recognition," Remote Sensing, vol. 10, no. 9, p. 1473, 2018.
[25] B. Li et al., "Towards practical lottery ticket hypothesis for adversarial training," arXiv preprint arXiv:2003.05733, 2020.
[26] L. Liu, P. Wang, J. Lin, and L. Liu, "Intrusion detection of imbalanced network traffic based on machine learning and deep learning," Ieee Access, vol. 9, pp. 7550-7563, 2020.
[27] A. Gramfort et al., "Scikit-Learn: Sklearn Preprocessing Minmaxscaler," ed: Accessed: Oct, 2019.
[28] E. W. Weisstein, "Fourier transform," https://mathworld. wolfram. com/, 2004.
[29] F. Scarselli, M. Gori, A. C. Tsoi, M. Hagenbuchner, and G. Monfardini, "The graph neural network model," IEEE transactions on neural networks, vol. 20, no. 1, pp. 61-80, 2008.
[30] W. F. Noh and P. Woodward, "SLIC (simple line interface calculation)," in Proceedings of the fifth international conference on numerical methods in fluid dynamics June 28–July 2, 1976 Twente University, Enschede, 1976: Springer, pp. 330-340.

指導教授

周立德(Li-Der Chou)

審核日期

2022-8-10

推文