# Labeling Expert: A New Multi-Network Anomaly Detection Architecture Based on LNN-RLSTM
### Challenge 3: Lack of Efficiency  
During network monitoring, the monitoring system must process millions or even billions of time series in real time. Especially for minute time series, the process of anomaly detection needs to be completed in a limited amount of time. Therefore, efficiency is one of the necessary prerequisites for online anomaly detection services. However, current anomaly detection methods are often computationally huge, and for supervised types of anomaly detection methods based on Bayes networks, neural networks for network intrusion detection require many samples [6]; support vector machine-based network detection has a high correct rate, but the time taken for anomaly detection is long and the real-time performance of network anomaly detection cannot be guaranteed [7]. These imply that supervised anomaly detection models, even though they can do well in terms of accuracy, have poor timeliness in online scenarios due to their large time complexity and space complexity. Based on the three types of problems presented above, a novel hybrid anomaly detection network structure is designed, LNN-RLSTM, which is a semi-supervised anomaly detection method. The reason to design semi-supervised is to adapt to the real-time monitoring application scenario where new anomaly types are constantly emerging. To address the issue of business logic exceptions, this article divides the categories of detection encountered in the business domain into anomaly isolated points and exception cycles. This algorithm solves the problem of few initial labels by combining the compressed window with the quadrature method. In terms of lack of specialization, artificial labels are added in the second-generation training set of the network, and by introducing artificial label data, LNN-RLSTM further solves the anomaly detection problem at the business level. Finally, to solve the problem of detection training time, artificial labels pre-training on the LNN-RLSTM network are pre-trained, so that the frequency of manual intervention for anomaly detection is continuously reduced and converges to a tiny value, thus, reducing the amount of model post-tuning, which, in turn, reduces the detection time and improves the detection in real time. The main contributions of this paper are as follows:  
1. A semi-supervised dual (LNN and RLSTM) neural network for detecting an anomaly in the time-series data. LNN was devised to train a neural network that can identify and label outliers in a \"sliding window\" and label individual data points according to the data distribution in a local range, while RLSTM can combine test results and solve \"detect local fragmentation problems\". 2. The concept of \"compression window\" is proposed to solve the problem of \"anomaly clustering\". The time complexity and space complexity of this algorithm are effectively reduced to O (length of window). 3. An improved LSTM model by adding a \"correlation gate\" as RLSTM to obtain the final outcome, which is adaptable to anomaly detection in a long time span. 4. The experiments were conducted on two separate sets of data. Network traffic detection data are extracted from Kaggle and China Big Data Challenge datasets to verify the effectiveness and hardness of the algorithms. The effectiveness and sensitivity of the detector are verified in terms of accuracy and false-positive rate. 5. The algorithm incorporates the process of manual tag input, effectively solving the problem of lack of business logic in detection. The rest of this article is organized as follows. Section 2 introduces the literature review and related work in anomaly detection. Section 3 describes drawbacks of the existing method and our research goals are proposed in the meantime. Section 4 describes the LNN-RLSTM method. Section 5 introduces the labeling neural network (LNN) in detail. Section 6 introduces relevant long short-term memory (RLSTM) in detail. Section 7 describes the data flow of LNN-RLSTM globally. Results and discussion are given in Section 8.