A CNN-BiLSTM Method Based on Attention Mechanism for Class-imbalanced Abnormal Traffic Detection

Abstract: Network traffic anomaly detection technology is an effective method for monitoring network security status and identifying potential attacks. With the increasing volume of network traffic data exhibiting high dimensionality and imbalance, traditional intrusion detection models face limitations in detection efficiency and accuracy. Existing intrusion detection methods often overlook issues related to temporal features in data and class imbalances, further hindering intrusion detection efficiency. In response to these challenges, this paper proposes an attention-based convolutional neural networks–long short-term memory (CNN-BiLSTM) network structure to enhance intrusion detection efficiency. By integrating CNN and BiLSTM networks to jointly learn spatio-temporal features of the data, and introducing an attention mechanism to deeply capture hidden feature relationships, this approach accelerates model convergence while balancing accuracy and efficiency. Additionally, to address class imbalance issues in network anomaly traffic, this study optimizes the cross-entropy loss function by introducing a cyclical focal loss function (CFL). This function cyclically adjusts the model's focus on different samples, thereby enhancing the detection rate of challenging samples and improving the model's generalization capabilities. Experiments conducted on the UNSW-NB15 datasets demonstrate that the proposed algorithm achieves a high accuracy of 97.09% while ensuring efficiency. Moreover, it effectively enhances the detection rate of imbalanced samples, highlighting its capability in handling class imbalances within anomaly traffic.

Keywords: abnormal traffic detection detection; attention mechanism; CNN-BiLSTM; imbalanced data