Comparison of Classification-based Methods for Network Traffic Anomaly Detection

With the development of technology, network technology is growing rapidly and there are more and more problems in the network, how to deal with anomaly traffic quickly and accurately in the network is a major problem that must be solved to achieve network security. This paper gives an overview of anomaly traffic and introduces three types of anomalies: point anomaly, contextual anomaly and collective anomaly, argues the relationship between anomalies, summarizes the latest publicly available datasets, focuses on the current classification approaches for handling network traffic anomalies, divides them into supervised multi-class classification approaches and unsupervised one-class classification approaches according to their learning types, and introduces some major development processes according to their respective. Finally, the advantages and shortcomings of multi-class classification and one-class classification approaches are summarized.