# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 3 Sketch-Based Profile Evolution for Network Traffic Abnormal Detection
### Detection Model  
The word detection comes from motion detection [43]. The key is to detect changes in images, and it is commonly used in automatic alarm systems and unattended monitoring systems. Detection models can dynamically deal with changing objects as well as detect and locate anomalies. It is characterized by dynamically capturing images over an ex-tended period of time, detecting abnormal conditions by comparing before and after images, and providing early warning of unusual location motion detection used in network traffic analysis. The network data flow is converted into the TG map of traffic behavior via the Sketch method, which corresponds to the actual image captured by the aid of the camera. The Profile of traffic behavior is generated through modeling to detect anomalies and locate them in the data flow. The core idea of motion detection is to automatically determine anomalies through image changes, so the detection model needs to have two characteristics: one is to process dynamically changing targets, and the other is to detect and locate anomalies to take follow-up processing. Motion detection can be divided into the following five parts: image generation, determination of \"default\" behavior, anomaly detection, anomaly localization, and early warning, as shown in Figure 1.  
We introduce the concept of motion detection in daily life monitoring into traffic monitoring in a network environment to realize the modeling and anomaly analysis of network behavior. The anomaly detection model for motion detection in the network environment should solve the following two problems:  
Figure 1: Motion detection models.  
The model needs to have the ability to process dynamic data. In actual monitoring, static analysis is not performed after collecting a segment of the image. To ensure security, image acquisition and analysis must be performed in real time. The detection model in this paper is based on the anomaly detection method. Since previous literature on anomaly detection has been analyzed based on static datasets, there is no dynamic anomaly detection for original network packets. Therefore, based on the network structuring results, this paper uses the Sketch method to generate a TG to complete the network traffic structuring process, realize the dynamic processing of network data flow, and provide features for the generation of Profile and model transitions in the next step. In addition, the generation of a TG can retain information on network traffic, which is equivalent to the abstraction in data flow mining. When an anomaly is found, the location of the anomaly can be located according to the TG, which is very important for practical applications. Since the data generated by network traffic is too large, manually searching for the anomaly will take a lot of time. Therefore, it is very necessary to store the summary information of network traffic in the form of TG.
2. Since the modeling of network traffic behavior in the existing literature is focused on anomaly detection and the processed data are static data, which is mostly modeled using statistics and probability distributions, the problem to be solved in this paper is how to establish a Profile based on the dynamic network traffic and change the Profile based on new data in real time. Therefore, this paper takes the original network data obtained as the analysis target, which is the Sketch-based method is used to generate the TG, and based on the TG, CNN and LSTM neural networks are used to extract spatial and temporal features and generate profiles. If the newly generated network traffic does not exceed the threshold for determining outliers, the Profile Evolution is based on the Profile and the newly generated network traffic.