Abstract:With the rapid development of network technology, the Internet has brought significant convenience to various sectors of society, holding a prominent position. Due to the unpredictable and severe consequences resulting from malicious attacks, the detection of anomalous network traffic has garnered considerable attention from researchers over the past few decades. Accurately labeling a sufficient amount of network traffic data as a training dataset within a short period of time is a challenging task, given the rapid and massive generation of network traffic data. Furthermore, the proportion of malicious attack traffic is relatively small compared to the overall traffic data, and the distribution of traffic data across different types of malicious attacks also varies significantly. To address the aforementioned challenges, this paper presents a novel network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing. Building upon the assumption of consistent distribution between labeled and unlabeled data, this paper introduces the multiclass split balancing strategy and the adaptive confidence threshold function. These innovative approaches aim to tackle the issue of the multiclass imbalanced in traffic data. By leveraging the mutually beneficial relationship between semi-supervised learning and ensemble learning, this paper presents the collaborative rotation forest algorithm. This algorithm is specifically designed to enhance performance of anomaly detection in an environment with label inadequacy. Several comparative experiments conducted on the NSL-KDD, UNSW-NB15, and ToN-IoT demonstrate that the proposed algorithm achieves significant improvements in performance. Specifically, it enhances precision by 1.5–5.7%, recall by 1.5−5.7%, and F-Measure by 1.4−4.3% compared to the state-of-the-art algorithms.

A Semi-Supervised Anomaly Network Traffic Detection Framework Via Multimodal Traffic Information Fusion

Semi-supervised Anomaly Traffic Detection Via Multi-Frequency Reconstruction

Semi-Supervised Learning for Anomaly Traffic Detection via Bidirectional Normalizing Flows

Network Anomaly Traffic Detection via Multi-view Feature Fusion

A multi-channel anomaly detection method with feature selection and multi-scale analysis

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Spatio-Temporal Network Traffic Estimation and Anomaly Detection Based on Convolutional Neural Network in Vehicular Ad-Hoc Networks

Unsupervised Anomalous Traffic Detection Based on Cascading Representation and Multiple-Clustering

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

Detection Network Anomalies Based on Packet and Flow Analysis

Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation

Dual-Stream Anomaly Detection Network for Real-World Traffic Scenarios

Network Traffic Anomaly Detection Method Based on Multi scale Residual Feature

A Three-Stage Anomaly Detection Framework for Traffic Videos

Global Spatio-Temporal Fusion-based Traffic Prediction Algorithm with Anomaly Aware

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

A Two-Stage Anomaly Detection Method Based on User Preference Features and the Deep Fusion Model

Anomalous Trafifc Detection Based on Trafifc Behavior Characteristics

Anomaly Event Detection in Security Surveillance Using Two-Stream Based Model

A multi-information fusion anomaly detection model based on convolutional neural networks and AutoEncoder

A BasisEvolution Framework for Network Traffic Anomaly Detection