Anomaly Detection Method Based on Clustering Undersampling and Ensemble Learning

Detecting abnormal traffic is important for network management. Aiming at the problem of data imbalance in traffic anomaly detection, an undersampling method based on clustering is used to process imbalanced data sets. Set the number of clusters in normal flow samples to the number of abnormal flow samples, and then use the cluster center nearest neighbor sample points as retained sample individuals to achieve the purpose of under-sampling. The effective fusion of clustering undersampling and Adaboost algorithm makes the algorithm pay more attention to samples that are difficult to judge in the data set, and further improves the effect of network traffic anomaly detection. K-RUSboost algorithm is simulated in Moore data set and iscxvpn2016 data set. The experimental results show that using this algorithm improves the recall rate of abnormal flow and maintains the false positive rate of abnormal flow at a relatively low level.