基于PFEN-MsTCN融合模型的网络安全态势评估

高新成, 陈哲伟

清华大学学报(自然科学版) ›› 2025, Vol. 65 ›› Issue (11) : 2236-2244.

PDF(2346 KB)
PDF(2346 KB)
清华大学学报(自然科学版) ›› 2025, Vol. 65 ›› Issue (11) : 2236-2244. DOI: 10.16511/j.cnki.qhdxxb.2025.27.055
网络与信息安全

基于PFEN-MsTCN融合模型的网络安全态势评估

作者信息 +

Network security situation assessment based on PFEN-MsTCN fusion model

Author information +
文章历史 +

摘要

针对现有网络安全态势评估模型存在特征提取粒度不足与长序列依赖捕捉能力薄弱的问题,该文提出一种融合并行特征提取网络(PFEN)与多尺度时间卷积网络(MsTCN)的评估模型。首先,从3个方面改进PFEN,以一维卷积替代二维卷积,优化分支结构,融合多种组件,有效增强特征提取能力,更为精准地提取流量异常行为模式和关键特征;其次,针对现有MsTCN存在膨胀率、核大小固定的局限,引入多核分支结构与层级化膨胀率对其进行改进,结合动态参数匹配策略以及Chomp1D层,有效解决多分支协同维度对齐问题,实现多尺度特征的动态覆盖和对复杂时序特征的全面捕捉;最后,将擅长局部特征提取的PFEN和适用于处理长期依赖关系的MsTCN有机融合,弥补单一模型的不足。通过NSL-KDD和CIC-IDS2017数据集的实验分析,模型在精确率、召回率和F1值上均优于对比模型,其中F1值在NSL-KDD和CIC-IDS2017数据集上分别达到87.39%和99.87%,验证了该方法的有效性和准确性。

Abstract

Objective: With the rapid development of network technology, cyberattacks have become increasingly severe, threatening the stability of cyberspace. Network security situation assessment (NSSA) has become a critical technology for building proactive defense systems by integrating multisource data to deliver comprehensive and dynamic evaluations of network states. Traditional rule-based methods and early learning-based models often lack sufficient granularity in feature extraction, struggling to capture long-range temporal dependencies, thereby limiting their effectiveness in detecting complex and diverse attack patterns. To address these limitations, this study proposes a novel evaluation framework that integrates a parallel feature extraction network (PFEN) and a multiscale temporal convolutional network (MsTCN) to enhance fine-grained feature extraction and long-term dependency modeling for network traffic data. Methods: The proposed PFEN-MsTCN model introduces two major technical contributions. First, the PFEN is tailored for sequential traffic data by modifying the conventional Inception module, replacing two-dimensional convolutions with one-dimensional convolutions to extract temporal features along the sequence axis. The multibranch structure is optimized into cascaded subnetworks to capture local and contextual temporal features. The integration of convolution, batch normalization, and ReLU activation enhances nonlinearity and robustness, effectively reducing computational complexity while maintaining feature quality. Second, MsTCN is improved by introducing a multikernel branching structure and a hierarchical dilation rate to dynamically capture multiscale temporal features. A dynamic parameter matching mechanism and Chomp1D layer ensure multibranch output alignment, preventing dimensional mismatches during feature fusion. This design enables the simultaneous detection of short-term bursts and long-range dependencies. Finally, the strengths of PFEN in local feature extraction and MsTCN in sequence modeling are seamlessly integrated, creating a robust hybrid model. Results: Comprehensive experiments on the NSL-KDD and CIC-IDS2017 benchmark datasets involved preprocessing with normalization, one-hot encoding of categorical features, and removal of redundant or invalid features to ensure high-quality input. Experimental results demonstrate that the PFEN-MsTCN model consistently outperforms the baseline models, including PFEN-ABiGRU, SEAE-CNN-BiGRU-AM, CNN-TCN, and Inception1D-MsTCN. On the NSL-KDD dataset, the proposed model achieved an F1-score of 87.39%, surpassing competing methods by 2.54%-4.88%, while maintaining lower mean squared error and mean absolute error values. On the CIC-IDS2017 dataset, the proposed model achieved an outstanding F1-score of 99.87% with reduced prediction error, demonstrating superior adaptability to heterogeneous and imbalanced data. The visualization of situation values further verified that PFEN-MsTCN aligns more closely with the ground truth than competing models. Furthermore, the proposed evaluation index system, incorporating attack impact, probability, and frequency factors, enabled accurate quantification of security situation values and precise risk level classification. Conclusions: The PFEN-MsTCN fusion model effectively addresses the challenges of existing NSSA methods by enhancing feature extraction granularity and improving the capture of long-term temporal dependencies. By integrating multibranch one-dimensional convolutional feature extraction with hierarchical multiscale temporal convolution, the model achieves precise recognition of abnormal traffic behaviors and robust temporal dependency modeling. The experimental results validate the superior performance of the proposed model in terms of accuracy, robustness, and generalization across datasets, establishing its potential as a reliable tool for intelligent network security assessment. Future research will focus on improving the recognition accuracy for small-sample attack types in imbalanced datasets and extending the framework to real-time and large-scale deployment scenarios, further enhancing its applicability in practical cyberspace defense systems.

关键词

网络安全态势评估 / 并行特征提取 / 多尺度时间卷积网络 / 长期依赖关系

Key words

network security situation assessment / parallel feature extraction / multi-scale temporal convolutional network / long-range temporal dependencies

引用本文

导出引用
高新成, 陈哲伟. 基于PFEN-MsTCN融合模型的网络安全态势评估[J]. 清华大学学报(自然科学版). 2025, 65(11): 2236-2244 https://doi.org/10.16511/j.cnki.qhdxxb.2025.27.055
Xincheng GAO, Zhewei CHEN. Network security situation assessment based on PFEN-MsTCN fusion model[J]. Journal of Tsinghua University(Science and Technology). 2025, 65(11): 2236-2244 https://doi.org/10.16511/j.cnki.qhdxxb.2025.27.055
中图分类号: TP393.08   

参考文献

1
LIU X H , ZHANG H W , ZHANG Y C , et al. Optimal network defense strategy selection method based on evolutionary network game[J]. Security and Communication Networks, 2020, 2020, 5381495.
2
王金恒, 单志龙, 谭汉松, 等. 基于遗传优化PNN神经网络的网络安全态势评估[J]. 计算机科学, 2021, 48 (6): 338- 342.
WANG J H , SHAN Z L , TAN H S , et al. Network security situation assessment based on genetic optimized PNN neural network[J]. Computer Science, 2021, 48 (6): 338- 342.
3
赵冬梅, 宋会倩, 张红斌. 基于时间因子和复合CNN结构的网络安全态势评估[J]. 计算机科学, 2021, 48 (12): 349- 356.
ZHAO D M , SONG H Q , ZHANG H B . Network security situation based on time factor and composite CNN structure[J]. Computer Science, 2021, 48 (12): 349- 356.
4
YANG H Y , ZHANG Z X , XIE L X , et al. Network security situation assessment with network attack behavior classification[J]. International Journal of Intelligent Systems, 2022, 37 (10): 6909- 6927.
5
赵冬梅, 孙明伟, 宿梦月, 等. 基于改进SKNet-SVM的网络安全态势评估[J]. 应用科学学报, 2024, 42 (2): 334- 349.
ZHAO D M , SUN M W , SU M Y , et al. Network security situation assessment based on improved SKNet-SVM[J]. Journal of Applied Sciences, 2024, 42 (2): 334- 349.
6
ZHAO D M , SHEN P C , HAN X Z , et al. Security situation assessment in UAV swarm networks using TransReSE: A Transformer-ResNeXt-SE based approach[J]. Vehicular Communications, 2024, 50, 100842.
7
杨宏宇, 张梓锌, 张良. 基于并行特征提取和改进BiGRU的网络安全态势评估[J]. 清华大学学报(自然科学版), 2022, 62 (5): 842- 848.
YANG H Y , ZHANG Z X , ZHANG L . Network security situation assessments with parallel feature extraction and an improved BiGRU[J]. Journal of Tsinghua University (Science and Technology), 2022, 62 (5): 842- 848.
8
YANG H Y , ZENG R Y , XU G Q , et al. A network security situation assessment method based on adversarial deep learning[J]. Applied Soft Computing, 2021, 102, 107096.
9
郭尚伟, 刘树峰, 李子铭, 等. 基于融合模型的网络安全态势感知方法[J]. 计算机工程, 2024, 50 (11): 1- 9.
GUO S W , LIU S F , LI Z M , et al. Network security situation awareness method based on fusion model[J]. Computer Engineering, 2024, 50 (11): 1- 9.
10
SZEGEDY C, LIU W, JIA Y Q, et al. Going deeper with convolutions[C]//Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Boston, USA: IEEE, 2015: 1-9.
11
HEWAGE P , BEHERA A , TROVATI M , et al. Temporal convolutional neural (TCN) network for an effective weather forecasting using time-series data from the local weather station[J]. Soft Computing, 2020, 24 (21): 16453- 16482.
12
邓飞跃, 陈哲, 郝如江, 等. 基于MsTCN-Transformer模型的轴承剩余使用寿命预测研究[J]. 振动与冲击, 2024, 43 (4): 279- 287.
DENG F Y , CHEN Z , HAO R J , et al. Research on bearing remaining useful life prediction based on an MsTCN-Transformer model[J]. Journal of Vibration and Shock, 2024, 43 (4): 279- 287.
13
HOUMB S H , FRANQUEIRA V N L , ENGUM E A . Quantifying security risk level from CVSS estimates of frequency and impact[J]. Journal of Systems and Software, 2010, 83 (9): 1622- 1634.
14
中共中央、国务院印发《国家突发事件总体应急预案》[EB/OL]. (2025-02-25)[2025-05-21]. https://www.news.cn/politics/zywj/20250225/a0c06e30ad36490697fbf780530839e4/c.html.
The Central Committee of the Communist Party of China and the State Council issued the "Overall Emergency Plan for National Emergencies"[EB/OL]. (2025-02-25)[2025-05-21]. https://www.news.cn/politics/zywj/20250225/a0c06e30ad36490697fbf780530839e4/c.html. (in Chinese)
15
SU T T , SUN H Z , ZHU J Q , et al. BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset[J]. IEEE Access, 2020, 8, 29575- 29585.
16
PANIGRAHI R , BORAH S . A detailed analysis of CICIDS2017 dataset for designing Intrusion detection systems[J]. International Journal of Engineering & Technology, 2018, 7 (3.24): 479- 482.
17
MOUSTAFA N , SLAY J . The evaluation of Network anomaly detection systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set[J]. Information Security Journal: A Global Perspective, 2016, 25 (1-3): 18- 31.
18
高新成, 张宣, 樊本航, 等. 基于改进的CNN-Transformer加密流量分类方法[J]. 吉林大学学报(理学版), 2024, 62 (3): 683- 690.
GAO X C , ZHANG X , FAN B H , et al. Improved CNN-transformer based encrypted traffic classification method[J]. Journal of Jilin University (Science Edition), 2024, 62 (3): 683- 690.

基金

国家自然科学基金青年科学基金项目(61702093)
中国高校产学研创新基金项目(2021ITA02011)

版权

版权所有,未经授权,不得转载。
PDF(2346 KB)

审稿意见

Accesses

Citation

Detail

段落导航
相关文章

/