Traffic Anomaly Detection Method Based On Improved RNN And Density Clustering

In recent years,the scale of the Internet has grown rapidly.The management and monitoring of networks have become more important.The detection of anomalies in network traffic can provide critical decision-making assistance for various tasks such as network management and security alert,which is of great significance.So far,there have been many studies on traffic anomaly detection.However,they still have some limitations.For example,the traditional statistical model cannot adapt to the characteristics of network traffic like self-similarity,long correlation,etc.The artificial intelligence-based method requires a large amount of annotated data for training,which is not realistic.The clustering-based method is also too dependent on the clustering results.In addition,most of the current research studies focus more on the accuracy of anomaly detection but less on time efficiency which makes it hard to cope with anomalies in the network quickly.In order to improve the detection performance of the traditional network traffic anomaly detection method and solve the problem of low time,efficiency,a comprehensive anomaly detection method based on traffic prediction and density clustering is proposed in this paper.Considering that the actual collected traffic data is not labeled,we will improve the anomaly detection method based on unsupervised density clustering.In order to solve the problem of high-dimensional failure that may exist in cluster-based anomaly detection,we preprocess the traffic data by improved traffic prediction method,and then the prediction result is used as the input of anomaly detection.To solve the problem of long-term dependence of most neural network-based traffic prediction methods,this paper proposes a traffic prediction method based on an improved recurrent neural network with great speed and prediction accuracy.Firstly,based on the Clockwork RNN we introduce the idea of random weight and replace the hidden layer module with the echo state reservoir to simplifies the structure and improves the training speed.Then,the hidden layer activation rule is modified.Each reservoir is activated by the record information corresponding to the clock in each step of training so that each output can get the information of all hidden layer modules.It is verified by simulation experiments that the proposed method can provide accurate prediction results and has a faster training speed.To solve the problem that the local characteristics of the sample are insufficiently considered and low detection accuracy in density clustering-based detection method,this paper proposes an anomaly detection method based on improved density clustering.Firstly,to solve the problem that the anomaly detection effect is poor when clustering the one-dimensional time series traffic,the traffic prediction result of CW-RNN is used for clustering input to improve the accuracy of anomaly detection.Then,based on the density peak clustering algorithm,the gravitational theory is introduced,and the new concept of potential energy is proposed to replace the original density.The K-nearest neighbor calculation method is also introduced to reduce the dependency on the truncation distance in the original algorithm.Finally,considered the local features of samples,we proposed the concept of potential energy gradient for further detection of outliers.Simulation results show that the proposed method can improve the accuracy of anomaly detection.