Code and dataset for malicious cloud service traffic detection based on multi-feature fusion

With the rapid growth of cloud computing, malicious attacks targeting cloud services have become more prevalent. We propose a method for detecting malicious cloud service traffic based on multi-feature fusion, addressing the issues of single feature extraction and weak generalization capabilities in traditional methods. By analyzing the attack patterns of malicious traffic, our model extracts features from both field attributes and statistical attributes of malicious requests. Furthermore, to enhance the generalization ability of the extracted features, a feature fusion algorithm based on an attention mechanism is employed for field feature fusion, and a feature selection algorithm based on the Gini coefficient and random forest is used for statistical feature selection. To balance the contribution of different types of features to the model during training, we propose a dual branch malicious request detection model, which processes and trains field feature vectors and statistical feature vectors through separate branches. After comparing currently available datasets for cloud service attack detection, this paper selects the HTTP dataset CSIC 2010 and a real-world cloud service log dataset for testing and validating the proposed method. Experimental results demonstrate that the proposed method exhibits strong competitiveness and achieves superior classification performance compared to other models. 

随着云计算技术的飞速发展，面向云服务的恶意攻击事件愈发频发。本文提出一种基于多特征融合的云服务恶意流量检测方法，以解决传统方法存在的特征提取单一、泛化能力较弱的问题。通过分析恶意流量的攻击模式，本模型从恶意请求的字段属性与统计属性两个维度提取特征。此外，为提升所提取特征的泛化能力，本文采用基于注意力机制（Attention Mechanism）的特征融合算法完成字段特征融合，并基于基尼系数（Gini Coefficient）与随机森林（Random Forest）的特征选择算法完成统计特征筛选。为平衡训练过程中不同类型特征对模型的贡献权重，我们提出双分支恶意请求检测模型，通过独立分支分别处理并训练字段特征向量与统计特征向量。在对比现有云服务攻击检测数据集后，本文选取HTTP数据集CSIC 2010与真实云服务日志数据集对所提方法进行测试与验证。实验结果表明，相较于其他模型，本方法具备较强的竞争力，可实现更优异的分类性能。