With the rapid development of the Internet, various types of anomaly traffic
are threatening network security. We consider the problem of anomaly network
traffic detection and propose a three-stage anomaly detection framework using
only normal traffic. Our framework can generate pseudo anomaly samples without
prior knowledge of anomalies to achieve the detection of anomaly data. Firstly,
we employ a reconstruction method to learn the deep representation of normal
samples. Secondly, these representations are normalized to a standard normal
distribution using a bidirectional flow module. To simulate anomaly samples, we
add noises to the normalized representations which are then passed through the
generation direction of the bidirectional flow module. Finally, a simple
classifier is trained to differentiate the normal samples and pseudo anomaly
samples in the latent space. During inference, our framework requires only two
modules to detect anomalous samples, leading to a considerable reduction in
model size. According to the experiments, our method achieves the state
of-the-art results on the common benchmarking datasets of anomaly network
traffic detection. The code is given in the
this https URL

利用正常流量，我们提出了一个基于三阶段异常网络流量检测的框架，该框架可以生成伪异常样本，无需先验知识即可检测异常数据，通过深度表示学习、标准化和噪声添加等步骤实现。该方法在公共基准数据集上取得了最先进的结果。