# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 1 Introduction  
With the rapid increase in the amount of data and the extensive use of network applications, the problem of network attacks in the field of network security is becoming more and more serious, and discovering abnormal problems in network traffic problems is now a critical problem to be solved. Abnormal network traffic refers to the phenomenon that the current state of network traffic deviates from the normal state of network traffic. Abnormal network traffic is (more often than not) brought on through malicious network attacks [1], such as denial-of-service attacks [2], port scanning [3], password blasting, far-flung control, etc., as well as network configuration errors and other exceptions. Therefore, network traffic anomaly detection [4; 5; 6; 7; 8; 9] is a necessary function to maintain security in cyberspace.  
Anomaly detection of network traffic comes from outlier detection [10]. The purpose of outlier detection is to identify objects that are significantly different from most data objects in the dataset. Therefore, outliers can be applied to the analysis of network behavior and detect anomalies that are generated in the network.  
The previous methods for detecting network traffic anomalies relied too heavily on manual feature selection, lacked adaptability, and could not directly process the original network traffic. On the other hand, in the face of massive high-dimensional traffic data, they cannot handle the dynamic data flow, and it is difficult to effectively extract key features and meet the real-time requirements of the system.  
To solve the above problems, Sketch Evolution is proposed for detecting abnormal network traffic. First, the historical network traffic is analyzed to build a normal behavioral model (Profile) of the network traffic, and then calculate the deviation of the contemporarynetwork traffic from the behavioral model of the normal network traffic. Thus, it is decided whether the network traffic is abnormal or not.  
To solve the above problems, Sketch-based Profile Evolution (SPE) for network traffic anomaly detection is proposed. SPE algorithm mainly includes three parts. The first part is to analyze the historical network traffic, that is, generate the Traffic Graph (TG) based on Sketch. The second part is to build the normal behavior model (Profile) of network traffic, and use CNN and LSTM to extract the spatial and temporal behavior characteristics to generate profiles. The third part is to calculate the deviation between the current new network traffic and the normal network traffic behavior model to judge whether the network traffic is abnormal. Compare the newly obtained network data with the Profile to determine whether abnormal behavior exists. Profiles are not fixed due to the addition of new data. Profiles evolve when new data streams are generated.  
The other contents of this paper are as follows: in the second part, the related work in the field of abnormal network traffic detection is presented. In the third part, we introduce the detection model, which is the generation process of the TG based on Sketch---that is, the structuring process of the network traffic, the modeling method of Profile, and the transition calculation process. The fourth part deals with the analysis of the experimental results, including the Profile analysis experiment and the network traffic solution analysis experiment. The fifth part describes the experimental conclusions and future work.  
In addition, the technique proposed in this paper has established commercial cooperation with Beijing Esafenet Development Technology Co., Ltd. (Beijing, China). It has been applied in Esafenet's DLP (Data Leakage Prevention) system to efficiently detect traffic with abnormal features in a continuous and dynamic network environment, and to provide it to the DLP system for defense measures in time.