Abstract:With the rapid development of network technology, the Internet has brought significant convenience to various sectors of society, holding a prominent position. Due to the unpredictable and severe consequences resulting from malicious attacks, the detection of anomalous network traffic has garnered considerable attention from researchers over the past few decades. Accurately labeling a sufficient amount of network traffic data as a training dataset within a short period of time is a challenging task, given the rapid and massive generation of network traffic data. Furthermore, the proportion of malicious attack traffic is relatively small compared to the overall traffic data, and the distribution of traffic data across different types of malicious attacks also varies significantly. To address the aforementioned challenges, this paper presents a novel network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing. Building upon the assumption of consistent distribution between labeled and unlabeled data, this paper introduces the multiclass split balancing strategy and the adaptive confidence threshold function. These innovative approaches aim to tackle the issue of the multiclass imbalanced in traffic data. By leveraging the mutually beneficial relationship between semi-supervised learning and ensemble learning, this paper presents the collaborative rotation forest algorithm. This algorithm is specifically designed to enhance performance of anomaly detection in an environment with label inadequacy. Several comparative experiments conducted on the NSL-KDD, UNSW-NB15, and ToN-IoT demonstrate that the proposed algorithm achieves significant improvements in performance. Specifically, it enhances precision by 1.5–5.7%, recall by 1.5−5.7%, and F-Measure by 1.4−4.3% compared to the state-of-the-art algorithms.

Online Adaptive Anomaly Detection for Augmented Network Flows

Flow Anomaly Telemetry Driven by Programmable Data Plane

Adaptive Anomaly Detection in Network Flows with Low-Rank Tensor Decompositions and Deep Unrolling

Research on Dynamic Data Flow Anomaly Detection based on Machine Learning

FlowGANAnomaly: Flow-Based Anomaly Network Intrusion Detection with Adversarial Learning

Large-Scale Ip Network Flow-Level Abnormal Behavior Trends Analysis Using Combined Anomaly Grey Forecasting Algorithm

Anomaly detection for network traffic flow

Anomaly Intrusion Detection Based on Data Stream

Adaptive and augmented active anomaly detection on dynamic network traffic streams

Subtle Anomaly Detection in Dynamic Networks Using Graph Spectra

Traffic Anomaly Detection Using Multi-Flows and Multi-Parameters in Backbone Network

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Detecting Anomalies In Communication Packet Streams Based On Generative Adversarial Networks

Unsupervised Abnormal Traffic Detection through Topological Flow Analysis

Micro-cluster-based Online Network Abnormal Detection Method

Network Anomaly Early Warning through Generalized Network Temperature and Deep Learning

A Novel Backbone Network Anomaly Detector Via Clustering In Sketch Space

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Flow-based intrusion detection on software-defined networks: a multivariate time series anomaly detection approach

Develop End-to-End Anomaly Detection System

A Comprehensive Augmentation Framework for Anomaly Detection