Traffic Anomaly Detection Research Articles

A Multi-Scale Temporal Feature Extraction Approach for Network Traffic Anomaly Detection

With the rapid advancement of network technology and the expanding scale of the Internet, network traffic data has grown exponentially, leading to increasingly prominent issues in network security. Many researchers are developing new network traffic anomaly detection models, but these models are difficult to effectively capture the multi-scale temporal characteristics of network traffic data and learn the correlation and importance among various feature dimensions. To this end, we propose a multi-scale temporal feature network (MSTFN-AM) based on an attention mechanism. MSTFN-AM integrates original data with temporal information through the temporal position encoding module and extracts multi-scale temporal features through the temporal feature extraction module. The temporal self-attention module can effectively identify dependencies and correlations between different time points. Ultimately, experiments conducted on two public datasets demonstrate that the MSTFN-AM model outperforms all baseline models in prediction performance.

Poison-Resilient Anomaly Detection: Mitigating Poisoning Attacks in Semi-Supervised Encrypted Traffic Anomaly Detection

Poison-Resilient Anomaly Detection: Mitigating Poisoning Attacks in Semi-Supervised Encrypted Traffic Anomaly Detection

TA-NET: Empowering Highly Efficient Traffic Anomaly Detection Through Multi-Head Local Self-Attention and Adaptive Hierarchical Feature Reconstruction

TA-NET: Empowering Highly Efficient Traffic Anomaly Detection Through Multi-Head Local Self-Attention and Adaptive Hierarchical Feature Reconstruction

Transformer-Based Spatio-Temporal Unsupervised Traffic Anomaly Detection in Aerial Videos

Transformer-Based Spatio-Temporal Unsupervised Traffic Anomaly Detection in Aerial Videos

Text-Driven Traffic Anomaly Detection With Temporal High-Frequency Modeling in Driving Videos

Text-Driven Traffic Anomaly Detection With Temporal High-Frequency Modeling in Driving Videos

Network Traffic Anomaly Detection Based on Spatiotemporal Feature Extraction and Channel Attention

To overcome the challenges of feature selection in traditional machine learning and enhance the accuracy of deep learning methods for anomaly traffic detection, we propose a novel method called DCGCANet. This model integrates dilated convolution, a GRU, and a Channel Attention Network, effectively combining dilated convolutional structures with GRUs to extract both temporal and spatial features for identifying anomalous patterns in network traffic. The one-dimensional dilated convolution (DC-1D) structure is designed to expand the receptive field, allowing for comprehensive traffic feature extraction while minimizing information loss typically caused by pooling operations. The DC structure captures spatial dependencies in the data, while the GRU processes time series data to capture dynamic traffic changes. Furthermore, the channel attention (CA) module assigns importance-based weights to features in different channels, enhancing the model’s representational capacity and improving its ability to detect abnormal traffic. DCGCANet achieved an accuracy rate of 99.6% on the CIC-IDS-2017 dataset, outperforming other algorithms. Additionally, the model attained precision, recall, and F1 score rates of 99%. The generalization capability of DCGCANet was validated on a subset of CIC-IDS-2017, demonstrating superior detection performance and robust generalization potential.

A novel multi-modal incremental tensor decomposition for anomaly detection in large-scale networks

Network traffic anomaly detection is a crucial task for today's network monitoring and maintenance. However, with the rapid growth of network data volume, the data structure has become more and more complex, showing multi-modal characteristics, which makes traffic anomaly detection face a great challenge. The earlier proposed anomaly detection methods have the following deficiencies, i) Most of them are static or dynamic detection methods that only grow along the temporal modality. ii) Lower detection rate or higher computational cost. To address these deficiencies, this article proposes a traffic anomaly detection framework based on multi-modal incremental tensor decomposition, which has the following three highlights, i) Constructing traffic data as a tensor model to fully mine the correlation between data, and the proposed framework is applicable to the situation where traffic data grows dynamically along multiple modes. ii) Using the multi-modal incremental tensor decomposition method to process dynamically growing data without decomposing all the data, greatly reducing computational cost and improving data quality. iii) Using the XGBoost classification algorithm for anomaly detection to improve detection accuracy. Finally, the results of experiments on two real network traffic datasets NSL-KDD and CICDDOS 2019 show that the proposed framework can achieve a high detection rate of 99.21%, and has the characteristics of good scalability and fast detection speed.

Traffic Anomaly Detection based on Spatio-Temporal Hypergraph Convolution Neural Networks

Traffic Anomaly Detection (TAD) is an important and difficult task in Intelligent Transportation Systems (ITS) . Traffic anomaly events are sparse in both spatial and temporal spaces, posing a challenge to the performance of model. Moreover, a single traffic anomaly event can impact multiple road sections in the neighborhood, further undermining the accuracy of TAD. In this paper, we propose a new TAD method based on spatio-temporal hypergraph convolutional neural network. Specifically, we adopt a spatial–temporal augmentation approach for traffic data. This will enhance the performance of detecting sparse anomalies. Meanwhile, we introduce a hypergraph learning method to model the road network. This could capture the spreading features of anomalies for better detection results. Additionally, we design a dynamic hypergraph construction method to extract the evolving relationships of road segments. The proposed model evaluation on the Beijing (SE-BJ) dataset for TAD reveals superior performance compared to state-of-the-art ones.

Traffic Anomaly Detection: Exploiting Temporal Positioning of Flow-Density Samples

Traffic Anomaly Detection: Exploiting Temporal Positioning of Flow-Density Samples

Detection and analysis of cellular network traffic anomalies and SMS spammers

The unfolding usage of mobile users inclusive of both 4G and 5G creates huge accumulation of data in cellular network. The network service providers need to ensure proper management of resource in terms of uninterrupted service with cost-effectiveness. The detection of cellular traffic and Short Message Service (SMS) spammers is very challenging. In this paper a novel method is proposed to analyse and detect the traffic anomalies and SMS spammers. To achieve this, Call Detail Record (CDR) issued by service provider is used. The CDR is pre-processed to convert into machine understandable format using mean-normalization technique. K-means clustering elbow method proves to be the best tool in identifying the traffic clusters in the network that detects both high and low traffic in the network. The novelty of the proposed work is the detection of low traffic clusters which usually is misled as sleeping cell or cell outage. The paper also presents a model designed to predict whether the message is spam SMS or ham SMS. The proposed model is suitable to run different classifiers like Logistic Regression, Multi nominal Naive Bayes, Support Vector Machine (SVM), Random Forest Classifier. The model gives the highest accuracy rate of 98.277% with SVM in detecting SMS spam.

MEDAVET: Traffic Vehicle Anomaly Detection Mechanism based on spatial and temporal structures in vehicle traffic

Road traffic anomaly detection is vital for reducing the number of accidents and ensuring a more efficient and safer transportation system. In highways, where traffic volume and speed limits are high, anomaly detection is not only essential but also considerably more challenging, given the multitude of fast-moving vehicles, often observed from extended distances and diverse angles, occluded by other objects, and subjected to variations in illumination and adverse weather conditions. This complexity has meant that human error often limits anomaly detection, making the role of computer vision systems integral to its success. In light of these challenges, this paper introduces MEDAVET - a sophisticated computer vision system engineered with an innovative mechanism that leverages spatial and temporal structures for high-precision traffic anomaly detection on highways. MEDAVET is assessed in its object tracking and anomaly detection efficacy using the UA-DETRAC and Track 4 benchmarks and has its performance compared with that of an array of state-of-the-art systems. The results have shown that, when MEDAVET’s ability to delimit relevant areas of the highway, through a bipartite graph and the Convex Hull algorithm, is paired with its QuadTree-based spatial and temporal approaches for detecting occluded and stationary vehicles, it emerges as superior in precision, compared to its counterparts, and with a competitive computational efficiency.

A Novel Split Learning-Based Consumer Electronics Network Traffic Anomaly Detection Framework for Smart City Environment

A Novel Split Learning-Based Consumer Electronics Network Traffic Anomaly Detection Framework for Smart City Environment

Traffic anomaly detection algorithm for CAN bus using similarity analysis

Recently, vehicles have experienced a rise in networking and informatization, leading to increased security concerns. As the most widely used automotive bus network, the Controller Area Network (CAN) bus is vulnerable to attacks, as security was not considered in its original design. This paper proposes SIDuBzip2, a traffic anomaly detection method for the CAN bus based on the bzip2 compression algorithm. The proposed method utilizes the pseudo-periodic characteristics of CAN bus traffic, constructing time series of CAN IDs and calculating the similarity between adjacent time series to identify abnormal traffic. The method consists of three parts: the conversion of CAN ID values to characters, the calculation of similarity based on bzip2 compression, and the optimal solution of model parameters. The experimental results demonstrate that the proposed SIDuBzip2 method effectively detects various attacks, including Denial of Service , replay, basic injection, mixed injection, and suppression attacks. In addition, existing CAN bus traffic anomaly detection methods are compared with the proposed method in terms of performance and delay, demonstrating the feasibility of the proposed method.

Detection of Network Security Traffic Anomalies Based on Machine Learning KNN Method

This paper discusses the application and advantages of machine learning in anomaly detection of network security traffic. By summarizing the existing methods and techniques of network anomaly detection, this paper focuses on the progress of clustering, classification, statistics, and information theory in research. In particular, innovations in data preprocessing, feature selection, and algorithm design, such as experimental validation based on an improved KNN algorithm, demonstrate the potential of machine learning in improving detection accuracy and efficiency. In the future, as the amount of data increases and algorithms are further optimized, these technologies are expected to drive further development in cybersecurity and address the challenges of increasingly complex cyber threats.

Graph autoencoder with mirror temporal convolutional networks for traffic anomaly detection

Traffic time series anomaly detection has been intensively studied for years because of its potential applications in intelligent transportation. However, classical traffic anomaly detection methods often overlook the evolving dynamic associations between road network nodes, which leads to challenges in capturing the long-term temporal correlations, spatial characteristics, and abnormal node behaviors in datasets with high periodicity and trends, such as morning peak travel periods. In this paper, we propose a mirror temporal graph autoencoder (MTGAE) framework to explore anomalies and capture unseen nodes and the spatiotemporal correlation between nodes in the traffic network. Specifically, we propose the mirror temporal convolutional module to enhance feature extraction capabilities and capture hidden node-to-node features in the traffic network. Morever, we propose the graph convolutional gate recurrent unit cell (GCGRU CELL) module. This module uses Gaussian kernel functions to map data into a high-dimensional space, and enables the identification of anomalous information and potential anomalies within the complex interdependencies of the traffic network, based on prior knowledge and input data. We compared our work with several other advanced deep-learning anomaly detection models. Experimental results on the NYC dataset illustrate that our model works best compared to other models for traffic anomaly detection.

Trading off Coverage and Emergency for Hybrid Task Scheduling in Traffic Anomaly Detection

Trading off Coverage and Emergency for Hybrid Task Scheduling in Traffic Anomaly Detection

Self-adaptive traffic anomaly detection system for IoT smart home environments

Self-adaptive traffic anomaly detection system for IoT smart home environments

Enhanced Network Traffic Anomaly Detection: Integration of Tensor Eigenvector Centrality with Low-Rank Recovery Models

Enhanced Network Traffic Anomaly Detection: Integration of Tensor Eigenvector Centrality with Low-Rank Recovery Models

Network Traffic Anomaly Detection: A Revisiting to Gaussian Process and Sparse Representation

Network Traffic Anomaly Detection: A Revisiting to Gaussian Process and Sparse Representation

Analysis of Machine Learning Application in Campus Network Traffic Anomaly Detection

Abstract In this paper, machine learning algorithms are first utilized to extract features of campus network traffic, and then the multi-attention mechanism is introduced to fuse the massive features extracted at different scales. Unsupervised learning is used to propose a method for detecting network traffic anomalies, and simulation experiments are conducted to verify the model’s performance. The results show that the detection rates of machine learning algorithms are all above 80%, the false alarm rate basically stays below 10%. The machine algorithms have higher accuracy than other algorithms in network data flow anomaly detection. This study has important reference value for campus network security research and verifies the important role of machine learning algorithms in detecting anomalies in campus network traffic.