Network traffic anomaly detection method based on multi-scale residual classifier

Abstract

In view of the current research seldom consider the multi-scale characteristics of network traffic, which may lead to an inaccurate classification of anomalies and a high false alarm rate. In this paper, a network traffic anomaly detection method based on the multi-scale residual classifier (MSRC) is proposed. We use sliding windows to divide the network traffic into subsequences with different observation scales, use the wavelet transform technology to obtain the time–frequency information of each subsequence on multiple decomposition scales, design a stacked automatic encoder (SAE) to learn the distribution of input data, calculate the reconstruction error vector by using the constructed feature space, and learn the feature information of different scales in the reconstruction error vector by using the multipath residual group, and complete traffic anomaly detection through the lightweight classifier. Experimental results show that the detection performance of the proposed method for abnormal network traffic is improved compared with the traditional method. It is proved that large observation scales and more transformation scales have positive effects on discovering the potential diversity information in the original network traffic.