A Network Traffic Anomaly Detection Method Based on Shapelet and KNN

Network traffic anomaly detection is the foundation for discovering malicious attacks and securing network security. With the emergence of new technologies such as port masquerading and traffic encryption, traditional traffic anomaly detection methods face many difficulties in dealing with large-scale, high-dimensional, and diverse network traffic data, such as traffic features needing to be more abstract and the model being uninterpretable. In this paper, we construct a network traffic anomaly detection model based on shapelet and KNN (K-Nearest Neighbor). First, the backpropagation and k-shape algorithm are used to learn the set of shapelet instances; second, the DTW of the shapelet and the original sequence is calculated as attribute values to generate the transformed dataset of test set and shapelet; finally, combine with KNN classifier for network traffic anomaly detection. In this paper, multi-classification experiments are conducted on one available dataset, NSL-KDD with 99.18 \(\%\) accuracy, and the experimental results are analyzed for model solvability.