Abstract:With the rapid development of network technology, the Internet has brought significant convenience to various sectors of society, holding a prominent position. Due to the unpredictable and severe consequences resulting from malicious attacks, the detection of anomalous network traffic has garnered considerable attention from researchers over the past few decades. Accurately labeling a sufficient amount of network traffic data as a training dataset within a short period of time is a challenging task, given the rapid and massive generation of network traffic data. Furthermore, the proportion of malicious attack traffic is relatively small compared to the overall traffic data, and the distribution of traffic data across different types of malicious attacks also varies significantly. To address the aforementioned challenges, this paper presents a novel network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing. Building upon the assumption of consistent distribution between labeled and unlabeled data, this paper introduces the multiclass split balancing strategy and the adaptive confidence threshold function. These innovative approaches aim to tackle the issue of the multiclass imbalanced in traffic data. By leveraging the mutually beneficial relationship between semi-supervised learning and ensemble learning, this paper presents the collaborative rotation forest algorithm. This algorithm is specifically designed to enhance performance of anomaly detection in an environment with label inadequacy. Several comparative experiments conducted on the NSL-KDD, UNSW-NB15, and ToN-IoT demonstrate that the proposed algorithm achieves significant improvements in performance. Specifically, it enhances precision by 1.5–5.7%, recall by 1.5−5.7%, and F-Measure by 1.4−4.3% compared to the state-of-the-art algorithms.

Research on DNS Anomaly Detection Technology Based on Multiple Features

DNS Abnormal Behavior Detection Based on IPFIX

User Online Detection Algorithm Based on DNS Log Analysis

Network Anomaly Detection and Localization

Application of Local Outlier Factor Algorithm to Detect Anomalies in Computer Network

DNS covert channel detection method using the LSTM model

DNSRadar: Outsourcing Malicious Domain Detection Based on Distributed Cache-Footprints

Visualizing and Characterizing Dns Lookup Behaviors Via Log-Mining

Research on Monitoring and Diagnosis Technology of Data Anomaly in Distribution Network

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

High-speed anomaly traffic detection based on staged frequency domain features

A comprehensive survey on DNS tunnel detection

Analysis Method of Multi-Source Flow Characteristics and Its Application in Anomaly Detection

An Effective Method for Computer Network Anomaly Detection

Research on the detection of abnormal traffic for multi-channel network

A DNS Tunnel Sliding Window Differential Detection Method Based on Normal Distribution Reasonable Range Filtering

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

Research on energy spectrum anomaly detection method for state control radiation environmental monitoring based on LOF algorithm

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Internet Anomaly Detection Based on Complex Network Path

Symmetry Degree Measurement and Its Applications to Anomaly Detection