Abstract:As the digital world becomes the main complement to the physical world, establishing a solid line of defense against cyber attacks becomes critical and arduous. The intrusion detection systems (IDSs) based on the supervised learning method have achieved excellent performance, which requires a large amount of labeled data in the training phase. However, attacks occur much less frequently than normal behaviors, and it is difficult to obtain accurate labels. In addition, IDSs based on supervised learning cannot identify unknown attacks. At the same time, the problem that detection accuracy varies greatly with different applications is very significant in traditional unsupervised learning methods. Therefore, it is necessary to perform high-precision anomaly detection on unlabeled samples. This paper proposes a traffic anomaly detection model using K-means and Active Learning Method (ALM), which is mainly composed of a feature extraction module and an anomaly detection module. Firstly, the Pearson correlation coefficient and Light Gradient Boosting Machine (LightGBM) are used in the feature extraction module to select important features. Secondly, K-means divides the characteristic-processed traffic into normal or abnormal categories. Finally, the results of K-means are diffused through ALM, and new classification results are obtained after defuzzification, thereby improving the accuracy of anomaly detection. The latest CICDDoS2019 data set is used in the experiment. Experimental results show that the detection accuracy of the proposed model is above 90%, and the F1 score is above 95%, regardless of whether it is a binary classification of a single attack or a mixed classification of multiple attacks. Compared with three unsupervised learning methods K-means, Auto-encoder and short-term memory (LSTM) and three supervised learning methods Naive Bayes (NB), Support Vector Machine (SVM), Decision Tree (DT), the proposed model has higher classification accuracy and better generalization effect. This article is very helpful for exploring the application of unsupervised learning methods in network intrusion detection systems based on the characteristics of the data itself.

A Network Traffic anomaly Detection method based on CNN and XGBoost

Abnormal Network Traffic Detection Algorithm Based on Improved Convolutional Neural Network

Spatio-Temporal Network Traffic Estimation and Anomaly Detection Based on Convolutional Neural Network in Vehicular Ad-Hoc Networks

Anomaly Network Traffic Detection Based on Deep Transfer Learning.

Design of Network Traffic Anomaly Detection Algorithm Based on Deep Convolutional Neural Network

Abnormal Traffic Detection Based on Attention and Big Step Convolution

Research on Anomaly Network Detection Based on Self-Attention Mechanism

Enhanced Anomaly Traffic Detection Framework Using BiGAN and Contrastive Learning

A CNN-BiLSTM Method Based on Attention Mechanism for Class-imbalanced Abnormal Traffic Detection

Web Traffic Anomaly Detection Using a Hybrid Spatio-temporal Neural Network

Traffic Anomaly Detection Model Using K-Means and Active Learning Method

Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation

A Novel Multi-Modal Incremental Tensor Decomposition for Anomaly Detection in Large-Scale Networks

Research on Network Security Filtering Model and Key Algorithms Based on Network Abnormal Traffic Analysis

GSOOA-1DDRSN: Network traffic anomaly detection based on deep residual shrinkage networks

A Lightweight Bit-Operation Abnormal Traffic Detection Method Based On XNOR-CNN.

Network anomaly detection using deep learning techniques

Network Traffic Anomaly Detection Based on Spatiotemporal Feature Extraction and Channel Attention

Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis

Network Anomaly Early Warning through Generalized Network Temperature and Deep Learning

NIN-DSC: A Network Traffic Anomaly Detection Method Based on Deep Learning