Anomalous Network Traffic Detection Based on CK Sketch and Machine Learning

Abstract

Listen

Translate article

AbstractThe rapid development of the explosive growth of the network traffic and new networks, such as cloud computing and IoT have challenged the traditional network measurement techniques with limited memory resources and computational resources. The measurement method based on sketch structure can compress and store massive traffic data by hash calculation, which facilitates statistical analysis in limited memory and has a greater impact on anomalous traffic detection. Current researches show that using sketch structure to store network traffic and combining it with machine learning to detect anomalous traffic in network traffic can solve the above problem effectively. However, the classical sketch structure has some problems such as hash collision and low memory usage, etc., which in turn affect the accuracy of machine learning models for anomalous traffic detection. In this paper, an improved sketch structure is proposed based on the cuckoo hash and CK Sketch structure which replaces the hash function in the classical sketch with the mechanism of cuckoo hash to avoid hash conflict, adds Bloom filter, and can self-adaption allocate the number of Hash buckets. By storing the anomalous traffic data as CK Sketch structure and classical sketch structure respectively, and conducting the anomalous traffic detection comparison experiments with machine learning respectively, the experimental results show that the CK sketch structure proposed in this paper can effectively improve the accuracy of machine learning to determine the anomalous traffic, the utilization rate of hash buckets and the network throughput.KeywordsSketchCuckoo hashMachine learningAnomalous network traffic detection