Anomaly traffic detection is a crucial issue in cyber-security field. Traditionally, many researchers have approached anomaly traffic detection as a supervised classification problem. However, in real-world scenarios, anomaly network traffic is unpredictable, dynamic, and difficult to collect. To address these challenges, we adopt an anomaly detection setting that trains using only normal traffic data and propose a novel semi-supervised method: Multi-Frequency Reconstruction (MFR). Our approach is driven by a key observation: traffic images often lack explicit patterns and texture features, making accurate modeling of normal traffic difficult. To overcome this limitation, we employ low-pass filters to extract multi-scale low-frequency information, offering a more effective multi-view perspective to identify anomaly patterns. Additionally, we introduce a channel-spatial attention mechanism within reconstruction models to enhance the network’s ability to capture the spatio-temporal features of traffic flows. Ultimately, to adequately leverage multi-view information, we integrate anomaly scores from multi-frequency branches, achieving a more comprehensive anomaly detection. Extensive experiments on three public anomaly traffic detection datasets demonstrate the superior performance of our method, outperforming state-of-the-art approaches by 4.6% and 10.5% in AUROC on the DataCon2020 and CIC-IDS2017 datasets, respectively.
Read full abstract