Abstract:With the rapid development of network technology, the Internet has brought significant convenience to various sectors of society, holding a prominent position. Due to the unpredictable and severe consequences resulting from malicious attacks, the detection of anomalous network traffic has garnered considerable attention from researchers over the past few decades. Accurately labeling a sufficient amount of network traffic data as a training dataset within a short period of time is a challenging task, given the rapid and massive generation of network traffic data. Furthermore, the proportion of malicious attack traffic is relatively small compared to the overall traffic data, and the distribution of traffic data across different types of malicious attacks also varies significantly. To address the aforementioned challenges, this paper presents a novel network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing. Building upon the assumption of consistent distribution between labeled and unlabeled data, this paper introduces the multiclass split balancing strategy and the adaptive confidence threshold function. These innovative approaches aim to tackle the issue of the multiclass imbalanced in traffic data. By leveraging the mutually beneficial relationship between semi-supervised learning and ensemble learning, this paper presents the collaborative rotation forest algorithm. This algorithm is specifically designed to enhance performance of anomaly detection in an environment with label inadequacy. Several comparative experiments conducted on the NSL-KDD, UNSW-NB15, and ToN-IoT demonstrate that the proposed algorithm achieves significant improvements in performance. Specifically, it enhances precision by 1.5–5.7%, recall by 1.5−5.7%, and F-Measure by 1.4−4.3% compared to the state-of-the-art algorithms.

High-speed anomaly traffic detection based on staged frequency domain features

Packet Payload Based Anomalous Network Intrusion Detection

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

Research on the detection of abnormal traffic for multi-channel network

MBST: Detecting Packet-Level Traffic Anomalies by Feature Stability

Network Traffic Anomaly Detection Method Based on Multi scale Residual Feature

Anomaly Detection Based on Traffic Information Structure

Research on Dynamic Data Flow Anomaly Detection based on Machine Learning

Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

Network Anomaly Detection Based On Multi-Scale Dynamic Characteristics Of Traffic

Anomaly Intrusion Detection Based on Data Stream

Unsupervised Anomalous Traffic Detection Based on Cascading Representation and Multiple-Clustering

Fast Anomaly Identification Based on Multi-Aspect Data Streams for Intelligent Intrusion Detection Toward Secure Industry 4.0

Diagnosing Traffic Anomalies Using a Two-Phase Model

A Human-in-the-Loop Anomaly Detection Architecture for Big Traffic Data of Cellular Network

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

A multi-channel anomaly detection method with feature selection and multi-scale analysis

Traffic System Anomaly Detection Using Spatiotemporal Pattern Networks

SAWANT: Smart Window Based Anomaly Detection Using Netflow Traffic

Towards a High-speed Router-based Anomaly/Intrusion Detection System