A novel anomaly detection model for secure multipath QUIC communications by jointly using empirical mode decomposition and long short-term memory networks
Affiliations: [a] School of Software, Jiangxi Normal University, Nanchang, Jiangxi, China | [b] Jiangxi Provincial Engineering Research Center of Blockchain Data Security and Governance, Nanchang, Jiangxi, China | [c] Management Science and Engineering Center, Jiangxi Normal University, Nanchang, Jiangxi, China
Correspondence:
[*]
Corresponding author: Changgen Jiang, School of Software, Jiangxi Normal University, Nanchang 330022, China. E-mail: 003135@jxnu.edu.cn.
Abstract: In the era of rapid development of modern internet technology, network transmission techniques are continuously iterating and updating. The Quick UDP Internet Connections (QUIC) protocol has emerged as a timely response to these advancements. Owing to the strong compatibility and high transmission speed of QUIC, its extended version, Multipath QUIC (MPQUIC), has gained popularity. MPQUIC can integrate various transmission scenarios, achieving parallel transmission with higher bandwidth. However, due to some security flaws in the protocol, MPQUIC is susceptible to attacks from anomalous network traffic. To address this issue, we propose an MPQUIC traffic anomaly detection model based on Empirical Mode Decomposition (EMD) and Long Short-Term Memory (LSTM) networks, which can decompose and denoise data and learn the long-term dependencies of the data. Simulation experiments are conducted by obtaining MPQUIC traffic data under normal and anomalous conditions for prediction, analysis, and evaluation. The results demonstrate that the proposed model exhibits satisfactory prediction performance when trained on both normal and anomalous traffic data, enabling anomaly detection. Moreover, the evaluation metrics indicate that the EMD-LSTM-based model achieves higher accuracy compared to various traditional single models.
