A Light-weight Online Learning Framework for Network Traffic Abnormality Detection

Abstract

Network traffic monitoring plays a crucial role in maintaining the security and reliability of the communication networks. Although Machine Learning (ML) assisted abnormal traffic detection has been emerged as a promising paradigm, the existing data-driven learning-based approaches are faced with challenges on inefficient traffic feature extraction and high computational complexity, especially when taking the evolving property of traffic process into consideration. To this end, we establish an online learning framework for abnormality traffic detection by embracing Gaussian Process (GP) and Sparse Representation (SR). The contributions of this paper are two-fold: 1). We utilize a special kernel, i.e., mixture of Gaussian, to better explore and exploit the evolving traffic characteristics, so as to more accurately model network traffic. 2). To combat noise and modeling error, we formulate a feature vector based on Kullback-Leibler (KL) divergence to measure the difference between normal and abnormal traffic, based on which SR is adopted to perform robust binary classification. Finally, we demonstrate the superiority of the proposed framework in terms of detection accuracy through simulation.