A Threat Flow Classification Method Based on Feature Fusion and Weighted Attention

ABSTRACT With the rapid development of the Internet, the increasing network traffic has brought a greater burden to network management. At the same time, abnormal traffic attacks on network equipment pose significant security risks. Classifying network traffic on network devices is an important way to protect information security. However, due to the vast amount and high‐dimensional attributes of traffic data, existing traffic classification models are mostly complex in structure, with a large number of parameters, making them difficult to apply to network devices with limited computing resources. Hence, this paper proposes a threat flow classification method based on feature fusion and weighted attention (FFWCA) to save storage and computing costs while ensuring model accuracy. Firstly, it constructs a lightweight multiscale feature extraction module by dilated convolutions and1 × 1 $$ 1\times 1 $$ convolutions to fuse features of different receptive field sizes. Then, it constructs an inverted residual structure embedded with a weighted coordinate attention mechanism, to extract accurate features for traffic classification and mitigate the gradient vanishing phenomenon brought by the lightweight model, a chapter. Finally, it constructs a fully convolutional structure classifier to reduce the computational overhead brought by the fully connected layer classifier while ensuring the model's nonlinear complexity. FFWCA significantly reduces the model's computational overhead and the number of parameters by incorporating a lightweight multiscale feature extraction module and a weighted coordinate attention mechanism, so that it can be efficiently deployed on network devices with constrain computing resources. Experiments on two public network traffic datasets, Bot‐IoT and USTC‐TFC2016, demonstrate that FFWCA achieves a balance between performance and lightweight and is suitable for edge computing and IoT devices.