Autoperman: Automatic Network Traffic Anomaly Detection with Ensemble Learning

Network traffic, which records users’ behaviors, is valuable data resources for diagnosing the health of the network. Mining anomaly in network is essential for network defense. Although traditional machine learning approaches have good performance, their dependence on huge training data set with expensive labels make them impractical. Furthermore, after complex hyperparameters tuning, the detection model may not work. Facing these challenges, in this paper, we propose Autoperman through supervised learning. In Autoperman, machine learning algorithms with fixed hyperparameters as feature extractors are integrated, which utilize a small amount of training data to be initialized. Then Random Forest is selected as the anomaly classifier and achieves automatic parameters tuning via well studied online optimization theory. We compare the performance of Autoperman against traditional anomaly detection algorithms using public traffic datasets. The results demonstrate that Autoperman can perform about 6.9%, 34.2%, 4.3%, 2.2%, 37.6 % better than L-SVM, NL-SVM, LR, MLP, K-means, respectively.