Multi-Granularity Abnormal Traffic Detection Based on Multi-Instance Learning
Xin Jiang, Heng‐Ru Zhang, Yao Zhou · IEEE Transactions on Network and Service Management · 2023
In practical scenarios, abnormal network traffic detection often requires analysis of massive, high-dimensional, and unbalanced data. Popular detection methods waste time by processing each data stream separately. In this paper, we propose a multi-granularity abnormal network traffic detection algorithm based on multi-instance learning to address this issue. The bag generation technique randomly assembles a predetermined number of data packets into a bag. The bag mapping technique encodes each bag into a new feature space through clustering. The multi-granularity classification technique filters normal data efficiently at the bag granularity before detecting threats at the instance granularity. Experiments were carried out on five datasets in comparison to three state-of-the-art algorithms. Compared with the competing methods, the results show that the average efficiency of this method is increased by more than 10 ∼ 20 times, and the accuracy is slightly lower by 0.1 ∼ 0.8%.