# Labeling Expert: A New Multi-Network Anomaly Detection Architecture Based on LNN-RLSTM
## 4 Network Traffic Anomaly Detection Scheme Based on LNN-RLSTM Neural Network
### Initial Labeling of Exception Cycles  
First, it is necessary to emphasize that a completely new approach to anomaly cycle detection is necessary. Because in the face of a large number of anomalous data points, aggregation, the traditional clustering, LOF, and isolated forest algorithms [14; 20; 24] will not be able to identify the anomalous data points because the anomalous data clusters are very similar to the normal data clusters, both in terms of aggregation degree and density degree, as shown in Figure 5, the traditional unsupervised learning anomaly detection algorithm is invalid.  
The phenomenon of \"anomaly clustering\" occurs when the set of data points is abnormal in a certain period with respect to the whole KPI series. To effectively solve the problem of \"anomaly clustering\", the concept of \"compression window\" is innovatively proposed. This method intends to reduce the anomaly detection problem to the anomaly detection problem by compressing the data through the compression window, as shown in Figure 6. The main steps are as follows.  
Figure 4: Quartile detection on various KPI data.  
Figure 5: On the gathering of many anomalies.  
**Step 1:** Choose a suitable compression window size (in this paper, we choose a cycle length as the window size).  
**Step 2:** Find a point in the compression window with the shortest sum of Euclidean distances to all other points and use this point as the compression point.  
\[\text{Min}E=\sum_{x\in C_{i}}\left\|x-x_{k}\right\|^{2}x_{k}\in C_{i},k=1,2,\ldots\]  
\(C_{i}\) is the set of data points in the \(i\)-th cycle, \(x_{k}\) is the value of the kth data point in the cycle and \(x\) is the value of the current target data point.  
**Step 3:** The KPI value of the compressed point is used as the compressed value of the data in the window for dimensionality reduction.  
**Step 4:** Detect and mark the anomalies of the compressed new time series.  
**Step 5:** Decompress the detected data and the decompressed data of each cycle will carry the label value of the parent compression point.  
In this Algorithm 1, the rules for selecting the compression points are based on many experiments. In the case of Figure 7, the value of the compressed points will not exceed the threshold of the compressed sequence because the anomaly of the sequence is caused by very few anomalous isolated points, and most of the data points are not biased, and the very few anomalous isolated points can only pull the compressed points towards their own horizontal coordinates in this algorithm, without affecting the size of their indicators (if their indicators are normal). In the case of anomalies, such as Figure 8, the value of the compression points will significantly exceed the threshold of the compression sequence because many points within the compression window are \"biased\", causing the value of the compression points to increase. In summary, this paper uses the compression window to label the data points in the anomaly cycle to complete the task of detecting the anomaly cycle.  
Figure 6: Demonstration of the compressed window method.