# A Two-Stage Anomaly Detection Method Based on User Preference Features and the Deep Fusion Model
## 3 Proposed Method
### User Preference Feature-Based Detection Model  
Given that in a network, users acquire fixed habits over time. For instance, users may communicate with specific addresses during certain hours of the workday or search for information at a certain network site. Users' fixed habits could be described by virtue of a cache algorithm based on hotspot content, which could be applied to build a User Preference Feature-based detection model and detect anomalous traffic at the first level. This paper considers an ideal edge network, as shown in Figure 3. During normal access, we model the user's persistent access network flow duration. A set of tuples \(T=\left\{t_{a},t_{b}\right\}\) is used to represent the users' normal access, where \(0<t_{a}<t_{b}<24\), \(t_{a}\), \(t_{b}\in R\). Assume that for a certain user \(n\), the user preference of \(n\) during time \(\left(t_{i},t_{j}\right)\) could be described using \(P_{n}(t_{i},t_{j})=\log\frac{P\left(X\left(t_{i},t_{j}\right)\middle|V_{n} \right)}{P\left(X\left(t_{i},t_{j}\right)\right)}\), where \(X\left(t_{i},t_{j}\right)\) represents the event of user access during \(\left(t_{i},t_{j}\right)\), \(V_{n}\) represents the history event set of access during \(\left(t_{i},t_{j}\right)\) of user \(n\), and \(P\left(X\left(t_{i},t_{j}\right)\middle|V_{n}\right)\) represents the probability of user \(n\)'s access during \(\left(t_{i},t_{j}\right)\). Hence, the user \(n\)'s preference vector to time \(\left(t_{i},t_{j}\right)\) could be described as \(S_{\left(t_{i},t_{j}\right)}(n)=\frac{\sum_{\left(t_{i}\right)}\
icefrac{{P_{ n}(t_{i})}}{{\left\|X\left(t_{i},t_{j}\right)\right\|_{2}}}}{\left\|X\left(t_{i},t_{j} \right)\right\|_{2}}\). Similarly, during normal access, we model the user's access transmission data. A set of tuples \(C=\left\{c_{1},c_{2},c_{3}\ldots c_{n}\right\}\) is used to represent the user's normal access. Hence, the user preference of \(n\) to content  
Figure 2: Implementation framework for network anomaly traffic detection.  
k could be described using \(\mathrm{P_{n}(c_{k})}=\log\frac{\mathrm{P(X(c_{k})|V_{n})}}{\mathrm{P}\left(X(k,k )\right)}\), where \(\mathrm{X(c_{k})}\) represents the event of user n to content c\({}_{k}\), and V\({}_{n}\) represents the history event set of user n to content c\({}_{k}\). Thus, the user n's preference vector for content c\({}_{k}\) could be described as \(\mathrm{U_{(c_{k})}(n)}=\frac{\sum(c_{k})^{\mathrm{P_{n}(c_{k})}}}{\left\| \sum(c_{k})^{\mathrm{P_{n}(c_{k})}}\right\|_{2}}\). The rest preference (transmission rate and data fragmentation) can be modeled in the same manner, including time preference, content preference, and combination preference. The user preference can be described as \(\mathrm{Vec(n)}\), consisting of network flow duration, transmission data size, rate, and data fragmentation. When an attack occurs, the user's behavior is affected by the attack, and the user's normal usage begins to deviate. We use the cosine distance \(\mathrm{Dis(n,n^{\prime})}=\cos(\mathrm{Vec(n)},\mathrm{Vec(n^{\prime})})\) to measure the deviation. Now we employ the following algorithms for fast attack awareness.  
As Algorithm 1 describes, before real-time monitoring and awareness, we first upload the user-preference vector. Following that, check and calculate the user-preference vector after a short period of time \(\Delta\)t. We use cosine distance as the basis for discrimination. If the cosine distance is larger than the proposed threshold, that means anomalous traffic has been detected, where the threshold is crucial to distinguishing normal behavior from bad behavior caused by anomalous traffic.