Web Traffic Anomaly Detection Using a Hybrid Spatio-temporal Neural Network

Abstract

Nowadays, rapid development of Internet has brought a sharp increase in traffic data. Abnormal traffic haS serious impact on network security. Traffic anomaly detection can be achieved by extracting characteristics of network traffic to detect anomalous intrusions, and therefore, anomaly detection algorithms are of great significance to maintenance of network security. This work proposes a hybrid spatio-temporal neural network with attention named CTGA to effectively identify anomalous traffic. CTGA combines a Convolutional neural network (CNN), a Temporal convolutional network (TCN), a bidirectional Gated recurrent unit network (BiGRU), and a self-Attention mechanism. It automatically extracts temporal and spatial features of sequences from raw data by sliding window preprocessing followed by CNN, TCN, BiGRU, and the self-attention mechanism to detect anomalous data. CNN is used to extract spatial features of time sequences and reduce the loss of spatial information. In the sequence, TCN obtains short-term features. Long-term dependencies in the data are captured by BiGRU, and the self-attention mechanism obtains important information in the sequence. Finally, experiments with the real-life Yahoo S5 dataset prove that CTGA outperforms other approaches substantially.