Abstract: The Improved Pigeon Inspired Optimizer (IPIO) and Pyramid Convolution Neural Network (PyConv) are the foundation of a traffic anomaly detection approach that aims to address the issues of a high number of redundant features in network traffic and the low detection accuracy of machine learning methods. Firstly, a feature selection method based on IPIO is designed to reduce feature redundancy. The pigeon group is initialized to increase population quality and quicken convergence by estimating the feature set’s information gain rate. The present ideal solution is modified at random using a twostage mutation process, which also looks for solutions close to it to prevent local optimum formation. Second, deep feature extraction is implemented using PyConv. PyConv is made to use multiscale convolution kernels to extract features of various sizes and fuse them to create new features. Finally, the classification is realized by Softmax classifier to improve the accuracy of traffic anomaly detection. Experimental results on the UNSWNB15 dataset show that the proposed method significantly reduces redundant features while improving accuracy.

Key words: anomaly detection, improved pigeon inspired optimizer, pyramid convolution, feature selection, feature extraction

摘要： 针对网络流量中存在大量冗余特征以及机器学习方法检测准确率低的问题，提出一种基于改进鸽群算法(improved pigeon inspired optimizer, IPIO)和金字塔卷积网络(pyramid convolution neural network，PyConv)的流量异常检测方法.首先设计基于IPIO的特征选择方法，降低特征冗余性.通过计算特征集的信息增益率初始化鸽群提高种群质量，加快收敛速度；采用2阶段变异随机修改当前最优解的1个分量，在当前最优解的附近进行搜索，避免陷入局部最优.其次采用PyConv实现深度特征提取，PyConv设计以多尺度的卷积核提取不同大小的特征并进行融合得到新特征.最后通过Softmax分类器实现分类，提升流量异常检测的精度.在UNSWNB15数据集上的实验结果表明，所提方法在提升准确率的同时显著地减少了冗余特征.

关键词: 异常检测, 改进鸽群算法, 金字塔卷积, 特征选择, 特征提取