Journal on Communications ›› 2022, Vol. 43 ›› Issue (10): 65-76.doi: 10.11959/j.issn.1000-436x.2022195

• Papers • Previous Articles     Next Articles

Network traffic anomaly detection method based on multi-scale characteristic

Xueyuan DUAN1,2,3, Yu FU1, Kun WANG1,4, Taotao LIU1, Bin LI1   

  1. 1 Department of Information Security, Naval University of Engineering, Wuhan 430033, China
    2 College of Computer and Information Technology, Xinyang Normal University, Xinyang 464000, China
    3 Henan Key Laboratory of Analysis and Applications of Education Big Data, Xinyang Normal University, Xinyang 464000, China
    4 School of Mathematics and Information Engineering, Xinyang Vocational and Technical College, Xinyang 464000, China
  • Revised:2022-09-27 Online:2022-10-25 Published:2022-10-01
  • Supported by:
    The National Key Research and Development Program of China(2018YFB0804104)

Abstract:

Aiming at the problem that most of the traditional network traffic anomaly detection methods only pay attention to the fine-grained features of traffic data, and make insufficient use of multi-scale feature information, which may lead to low accuracy of anomaly detection results, a network traffic anomaly detection method based on multi-scale features was proposed.The original traffic was divided into sub-sequences with multiple observation spans by using multiple sliding windows of different scales, and the multi-level sequences of each sub-sequence were reconstructed by wavelet transform technology.Multi-level reconstructed sequences were generated by Chain SAE through feature space mapping, and a preliminary judgment of abnormality was made by the classifiers of each level according to the errors of the reconstructed sequences.The weighted voting strategy was adopted to summarize the preliminary judgment results of each level to form the final result judgment.Experimental results show that the proposed method can effectively mine the multi-scale feature information of network traffic, and the detection performance of abnormal traffic is obviously improved compared with traditional methods.

Key words: network traffic, anomaly detection, multi-scale characteristic, wavelet transformation

CLC Number: 

No Suggested Reading articles found!