## 2 Related Works  
The concept of abnormal traffic detection technology began in the 1980s, which refers to a network security technology that monitors network traffic transmission, promptly issues an alarm or takes active response measures when abnormal traffic is found. Anomaly detection obtains a feature model by modeling and analyzing traffic characteristics, thereby judging whether the network traffic is normal. Anomaly detection technology can be roughly divided into: that based on traffic feature matching, based on traffic feature statistics, and based on machine learning. There are essential differences in the modeling logic of the three traffic characteristics, which bring about different detection scenarios and inspection effects. Algorithms based on traffic feature matching require professionals to analyze and summarize the characteristics of abnormal traffic and then match them with the observed traffic characteristic. The advantage of this approach is the higher accuracy of identifying known attacks. However, algorithms based on traffic feature matching rely on expert knowledge and are difficult to deal with unseen abnormal network traffic. The anomaly detection algorithm based on data statistics is based on the normal distribution of network traffic characteristics. When the observed network traffic characteristics deviation from the benchmark exceeds a certain threshold, it is regarded as abnormal network traffic. The advantage of the algorithm based on data feature statistics is that it is simple to implement and can also identify abnormal traffic in unknown networks, but it is prone to misjudgment. Algorithms based on machine learning have a stronger learning ability and can learn from incomplete traffic characteristics to abnormal traffic, however, the models generally have high computational complexity and are not suitable for high-response environments. However, with the substantial improvement in computing technology, methods based on machine learning have received attention and research from all parties. Based on the traffic feature matching algorithm, the abnormal network traffic is known quickly, but it cannot effectively deal with the unknown abnormal network traffic. Ref. [8] proposed the model NADIR, a near real-time expert system, to replace the manual review log method. NADIR compares the network activity summarized in user profiles with expert rules that define network security policies, inappropriate or suspicious network activity, and normal network and user activity. Ref. [9] proposed an adaptive real-time intrusion detection expert system which contains a statistical subsystem to observe the normal traffic of the computer. The statistical subsystem identifies user behavior as a potential intrusion when it observes significant deviations from expected behavior. Ref. [9] maintains a knowledge base of statistical topics consisting of profiles, and updates the observed behaviors to the knowledge base daily. Before the new statistics are synchronized to the knowledge base, the previous statistics are multiplied by a decay factor to adaptively learn the behavior patterns of the observers. Ref. [10] proposed an approach to specification-based and anomaly-based intrusion detection by starting from the state machine specification of the network protocol and supplementing the state machine information with statistical information. Ref. [10] verified the effectiveness of this method on the KDD99 dataset. Furthermore, Ref. [10] uses a protocol specification to simplify the feature selection step. Ref. [11] described network intrusion detection expert system (NIDX) by combining knowledge describing the target system, the historical profiles of users' past activities, and knowledge-based intrusion detection heuristics. NIDX classifies user activity through the UNIX system calls and then uses knowledge and heuristics about typical intrusion and attack techniques to determine whether the activity is anomalous. [PERSON].