Multivariate time series traffic anomaly detection with Prediction & AutoEncoder

Recently, research on the detection of distributed Denial-of-Service(DDOS) abnormalities using network traffic data is actively underway. this is because malicious traffic continues to advance, causing great economic losses to oursociety. therefore, this study aims to build a more suitable model for use in thefield by detecting abnormalities distinct from normal and improving continuousabnormal detection accuracy based on multivariate traffic netflow data. the supervised learning method that directly utilizes data from the anomaly point of viewhas a fundamental limitation that it is difficult to respond to new types other thanpatterns as long as it is learned. Therefore, it was attempted to solve the problemthrough a semi-supervised learning method using only normal data. Therefore, wedesign a one class model structure that can improve classification performance fornormal and abnormal time points by applying a Multi-head Attention layer to theauto encoder layer. In addition, typical sequence-based anomaly detection modelshave recently become dominant, which can make it difficult to respond quickly toanomalies due to the normal points at the front of each sequence when appliedin the field. therefore, in order to supplement this, this study attempted to enable faster abnormal viewpoint detection by using a viewpoint prediction model through LSTM. In summary, we present a method to advance the performance ofthe model through an accurate and fast anomaly detection model by leveragingthe aforementioned reconstruction model and prediction model together.