关键词: 恶意流量检测；贝叶斯优化；注意力机制；循环神经网络；数据特征

Abstract: To address the limitations inherent in current malicious network traffic detection methods, specifically suboptimal detection accuracy and reliance on manual hyperparameter tuning, this study proposes a malicious traffic detection method based on Bayesian optimization and a spatiotemporal attention mechanism. It adopts bidirectional long short-term memory (BiLSTM) to extract temporal and spatial features of network traffic data, and leverages Bayesian optimization to search for optimal network hyperparameters.A bidirectional architecture extracts temporal and spatial features from network traffic data, while Bayesian optimization automatically searches for optimal network parameters. Innovatively, we introduce a Multi-scale Traffic Protocol Enhancement Module that significantly enhances spatiotemporal feature representation for complex attack chains through multi-level protocol parsing, dynamic feature fusion, and attention coordination. Concurrently, to establish deep correlations between spatiotemporal features, we propose a Multi-head Spatiotemporal Attention Mechanism. This employs four parallel attention heads to cooperatively model millisecond-level protocol transients, second-level interaction sequences, minute-scale attack chain evolution, and cross-protocol correlation characteristics, effectively improving detection accuracy for stealthy threats. Experimental validation on the CIC-IDS2017 dataset demonstrates that the proposed method achieves multiclass and binary classification accuracies of 99.46% and 99.59%, respectively, outperforming comparative approaches.

Key words: malicious traffic detection; Bayesian optimization; attention mechanism; recurrent neural network; data features