Multi-task Feature Learning Based Anomaly Detection of Network Dataflow

Aiming at the problem of network dataflow anomaly detection, a multi-task learning sample set is constructed by using the data in different periods. Low rank subspace and uncorrelated sparse mode are learned from multiple related tasks. The l₁-norm is scaled to l₀-norm, and rank function is scaled to trace-norm. Then the low rank subspace is used to capture the underlying potential similarity of all tasks, and the sparse discriminant features are used to represent the differences between tasks. Feature subsets from k tasks are the input of SVM anomaly detection classifier. The experimental results show that the proposed method can effectively capture the additional special features in addition to the shared features in the network dataflow anomaly detection, and has well achieved detection results.