Abstract:With the rapid development of network technology, the Internet has brought significant convenience to various sectors of society, holding a prominent position. Due to the unpredictable and severe consequences resulting from malicious attacks, the detection of anomalous network traffic has garnered considerable attention from researchers over the past few decades. Accurately labeling a sufficient amount of network traffic data as a training dataset within a short period of time is a challenging task, given the rapid and massive generation of network traffic data. Furthermore, the proportion of malicious attack traffic is relatively small compared to the overall traffic data, and the distribution of traffic data across different types of malicious attacks also varies significantly. To address the aforementioned challenges, this paper presents a novel network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing. Building upon the assumption of consistent distribution between labeled and unlabeled data, this paper introduces the multiclass split balancing strategy and the adaptive confidence threshold function. These innovative approaches aim to tackle the issue of the multiclass imbalanced in traffic data. By leveraging the mutually beneficial relationship between semi-supervised learning and ensemble learning, this paper presents the collaborative rotation forest algorithm. This algorithm is specifically designed to enhance performance of anomaly detection in an environment with label inadequacy. Several comparative experiments conducted on the NSL-KDD, UNSW-NB15, and ToN-IoT demonstrate that the proposed algorithm achieves significant improvements in performance. Specifically, it enhances precision by 1.5–5.7%, recall by 1.5−5.7%, and F-Measure by 1.4−4.3% compared to the state-of-the-art algorithms.

Unsupervised Anomalous Traffic Detection Based on Cascading Representation and Multiple-Clustering

Network traffic analysis over clustering-based collective anomaly detection

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

Network Traffic Anomaly Detection Method Based on Multi scale Residual Feature

High-speed anomaly traffic detection based on staged frequency domain features

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Unsupervised Anomaly Detection Based on Deep Autoencoding and Clustering

Towards a Unified Framework of Clustering-based Anomaly Detection

Anomaly Detection Based on Traffic Information Structure

A hybrid unsupervised clustering-based anomaly detection method

Network traffic anomaly detection model based on feature grouping and multi‐autoencoders integration

A Novel Backbone Network Anomaly Detector Via Clustering In Sketch Space

Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation

Detection of Anomalous Traffic Patterns and Insight Analysis from Bus Trajectory Data

Autoencoder-based Unsupervised Intrusion Detection using Multi-Scale Convolutional Recurrent Networks

Midbrain-to-pons ratio in autopsy-confirmed progressive supranuclear palsy: replication in an independent cohort

A multi-channel anomaly detection method with feature selection and multi-scale analysis

Research on the detection of abnormal traffic for multi-channel network

Anomaly Detection in Event-triggered Traffic Time Series Via Similarity Learning

Network Anomaly Detection Based On Multi-Scale Dynamic Characteristics Of Traffic

A Network Traffic anomaly Detection method based on CNN and XGBoost