Monitoring and Identification of Abnormal Network Traffic by Different Mathematical Models

Abstract

The presence of anomalous traffic on the network causes some dangers to network security. To address the issue of monitoring and identifying abnormal traffic on the network, this paper first selected the traffic features with the mutual information-based method and then compared different mathematical models, including k-Nearest Neighbor (KNN), Back-Propagation Neural Network (BPNN), and Elman. Then, parameters were optimized by the Grasshopper Optimization Algorithm (GOA) based on the defects of BPNN and Elman to obtain GOA-BPNN and GOA-Elman models. The performance of these mathematical models was compared on UNSW-UB15. It was found that the KNN model had the worst performance and the Elman model performed better than the BPNN model. After GOA optimization, the performance of the models was improved. The GOA-Elman model had the best performance in monitoring and recognizing abnormal traffic, with an accuracy of 97.33%, and it performed well in monitoring and recognizing different types of traffic. The research results demonstrate the reliability of the GOA-Elman model, providing a new approach for network security.

Unveiling the Digital Fingerprints: Analysis of Internet attacks based on website fingerprints

“…To address this challenge, [16] proposed a data mining-based network traffic anomaly monitoring system. In another approach, [17] tackled the issue of monitoring and identifying abnormal network traffic by employing mutual information-based feature selection and comparing various mathematical models for classification.…”