Abstract:The rapid development of Internet technology has brought great convenience to our production life, and the ensuing security problems have become increasingly prominent. These problems threaten users' privacy and pose significant security risks to the normal conduct of many aspects of society, such as politics, economy, culture, and people's livelihood. The growth of the information transmission rate expands the scope of attacks and provides a more attack environment for intruders. Abnormal detection is an effective security protection technology that can monitor network transmission in real-time, effectively sense external attacks, and provide response decisions for relevant managers. The development of machine learning has also led to the development of abnormal traffic detection technology. The goal has been to use powerful and fast learning algorithms to deal with changing threats and respond in real-time. Most of the current abnormal detection research is based on simulation, using public and well-known datasets. On the one hand, the dataset contains high-dimensional massive data, which traditional machine learning methods cannot be processed. On the other hand, the labeled data scale is far behind the application requirements, and the dataset's labels are all manually labeled, so the labeling cost is exceptionally high. This paper proposes a semi-supervised Double Deep Q-Network (SSDDQN)-based optimization method for network abnormal traffic detection, mainly based on Double Deep Q-Network (DDQN), a representative of Deep Reinforcement Learning algorithm. In SSDDQN, the current network first adopts the autoencoder to reconstruct the traffic features and then uses a deep neural network as a classifier. The target network first uses the unsupervised learning algorithm K-Means clustering and then uses deep neural network prediction. The experiment uses NSL-KDD and AWID datasets for training and testing and -erforms a comprehensive comparison with existing machine learning models. The experimental results show that SSDDQN has certain advantages in time complexity and achieved good results in various evaluation metrics.

A Semi-Supervised Learning Approach for Abnormal Event Prediction on Large Network Operation Time-Series Data

A Semi-Supervised Approach for Abnormal Event Prediction on Large Operational Network Time-Series Data

Network Abnormal Traffic Detection Model Based on Semi-Supervised Deep Reinforcement Learning

Segmentation-Based Adversarial Denoising Auto-Encoder for Anomaly Detection in Multivariate Time Series Data

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Distributed Online One-Class Support Vector Machine for Anomaly Detection over Networks

Accurate Anomaly Detection Leveraging Knowledge-enhanced GAT

AI-enabled Multi-modal Network Anomaly Association: A Deep Self/Semi-Supervised Learning Approach

A Novel Semi-supervised Anomaly Detection Method for Network Intrusion Detection

HybridAD: A Hybrid Model-Driven Anomaly Detection Approach for Multivariate Time Series

ASGNet: Adaptive Semantic Gate Networks for Log-Based Anomaly Diagnosis

ADA: Adaptive Deep Log Anomaly Detector

Self-Supervised Spatial-Temporal Normality Learning for Time Series Anomaly Detection

A Semi-supervised Approach for Industrial Anomaly Detection via Self-adaptive Clustering

Network Anomaly Detection Via Similarity-Aware Ensemble Learning with ADSIM

An efficient network behavior anomaly detection using a hybrid DBN-LSTM network

Learning Semantic Context from Normal Samples for Unsupervised Anomaly Detection

Adaptive Memory Networks with Self-supervised Learning for Unsupervised Anomaly Detection

ADSAD: An unsupervised attention-based discrete sequence anomaly detection framework for network security analysis

A Supervised Embedding and Clustering Anomaly Detection method for classification of Mobile Network Faults

A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data