将网络流量转为图像，用视觉变压器检测物联网僵尸网络攻击
IoT Botnet Detection: Application of Vision Transformer to Classification of Network Flow Traffic
- 把网络流数据转成2D图像输入视觉变压器
- 在两个数据集上达到高精度、召回率和F1分数
- 支持多种分类器，适合网络安全研究者
尽管变换器模型在自然语言处理、图像和视频分类中表现优异，但现有工具在提取捕获的物联网网络流数据特征时，既无法捕捉序列模式，也缺乏空间模式，限制了变换器的应用。本文提出一种新型预处理方法，使视觉变换器（ViT）能够用于基于网络流数据的物联网僵尸网络攻击检测。该方法从.pcap文件中提取特征，并将每个实例转换为单通道2D图像格式，从而实现基于ViT的分类。此外，对原始ViT模型进行了改进，使其可使用除多层感知机（MLP）外的任意分类器。在两个物联网攻击数据集上，传统前馈深度神经网络（DNN）、LSTM和双向LSTM（BLSTM）均表现出与基准相当的性能，在多类攻击检测任务中实现了较高的精确率、召回率和F1分数。
原文摘要 · Abstract (English)
Despite the demonstrated effectiveness of transformer models in NLP, and image and video classification, the available tools for extracting features from captured IoT network flow packets fail to capture sequential patterns in addition to the absence of spatial patterns consequently limiting transformer model application. This work introduces a novel preprocessing method to adapt transformer models, the vision transformer (ViT) in particular, for IoT botnet attack detection using network flow packets. The approach involves feature extraction from .pcap files and transforming each instance into a 1-channel 2D image shape, enabling ViT-based classification. Also, the ViT model was enhanced to allow use any classifier besides Multilayer Perceptron (MLP) that was deployed in the initial ViT paper. Models including the conventional feed forward Deep Neural Network (DNN), LSTM and Bidirectional-LSTM (BLSTM) demonstrated competitive performance in terms of precision, recall, and F1-score for multiclass-based attack detection when evaluated on two IoT attack datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。