Abstract:With the rapid development of network technology, the Internet has brought significant convenience to various sectors of society, holding a prominent position. Due to the unpredictable and severe consequences resulting from malicious attacks, the detection of anomalous network traffic has garnered considerable attention from researchers over the past few decades. Accurately labeling a sufficient amount of network traffic data as a training dataset within a short period of time is a challenging task, given the rapid and massive generation of network traffic data. Furthermore, the proportion of malicious attack traffic is relatively small compared to the overall traffic data, and the distribution of traffic data across different types of malicious attacks also varies significantly. To address the aforementioned challenges, this paper presents a novel network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing. Building upon the assumption of consistent distribution between labeled and unlabeled data, this paper introduces the multiclass split balancing strategy and the adaptive confidence threshold function. These innovative approaches aim to tackle the issue of the multiclass imbalanced in traffic data. By leveraging the mutually beneficial relationship between semi-supervised learning and ensemble learning, this paper presents the collaborative rotation forest algorithm. This algorithm is specifically designed to enhance performance of anomaly detection in an environment with label inadequacy. Several comparative experiments conducted on the NSL-KDD, UNSW-NB15, and ToN-IoT demonstrate that the proposed algorithm achieves significant improvements in performance. Specifically, it enhances precision by 1.5–5.7%, recall by 1.5−5.7%, and F-Measure by 1.4−4.3% compared to the state-of-the-art algorithms.

Network Traffic Classification Based on Semi-Supervised Clustering

A Semi-Supervised Clustering Method for Network Application Flow Classification

Information Entropy Based Clustering Method for Unsupervised Internet Traffic Classification

A Statistical-Feature-based Approach to Internet Traffic Classification Using Machine Learning.

Traffic Classification - Towards Accurate Real Time Network Applications

A Semi-Supervised Clustering Algorithm for Real Network Traffic with Concept Drift

Network Traffic Classification Algorithm Based on Spectral Clustering

Study on Internet Traffic Classification Using Machine Learning

Clustering Network Traffic Using Semi-Supervised Learning

Network Application Classification Method Based on Semi-Supervised Learning

Semi-supervised network traffic classification using deep generative models.

Towards a Profiling View for Unsupervised Traffic Classification by Exploring the Statistic Features and Link Patterns

Semi-supervised Internet Network Traffic Classification Using a Gaussian Mixture Model

Network Traffic Classification Using Further Division Of Partition Space

Network traffic classification based on federated semi-supervised learning

An enhanced self-learning-based clustering scheme for real-time traffic data distribution in wireless networks

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Identifying Traffic Clusters in Urban Networks Based on Graph Theory Using License Plate Recognition Data

Online Traffic Classification Based on Co-training Method

Optimizing Traffic Classification Using Hybrid Feature Selection

Modeling and clustering network-level urban traffic status based on traffic flow assignment ratios