# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 2 Related Works
The model combines multi-scale detection and digital signal processing theory to realize anomaly detection based on the self-similarity of MPTCP network traffic. This method uses the empirical mode decomposition (EMD) method to decompose MPTCP traffic data, and reconstructs effective signals by removing high frequency noise and residual trend terms. This model exploits the idea of a sliding window to compare the changes in the Hurst exponent of the MPTCP network under different attack conditions and decide whether an anomaly exists or not. The Sketch is a distributed profile data structure, which is widely used in network traffic anomaly detection and can process a large amount of data in a short time. [PERSON] et al. [20] proposed and developed a dynamic method for enhanced network flow anomaly detection. We delineate the network state during the creation of the data flow, enabling threat detection for general purposes. We describe an efficient flow augmentation method based on a count-minute sketch that provides per-flow-, per-node-, and per-network-level statistics in parallel with flow record generation. [PERSON] et al. [21] first proposed a general architecture on FPGA to speed up Sketch and deployed it in two widely used Sketches: Count-min Sketch and Kary Sketch. For two key network anomaly detection tasks, we propose online sketch-based algorithms: Heavy-Hitter Detection and Heavy-Change Detection. We use the proposed Sketch general architecture to accelerate these online algorithms. Machine learning methods mainly include classification, clustering, pattern recognition, neural networks, and decision trees. Machine learning-based methods can process large network traffic data briefly and correctly via self-learning methods. [PERSON] et al. [22] proposed an unsupervised anomaly detection method that combines Sub-Space Clustering (SSC) and One-Class Support Vector Machine (OCSVM), which can detect attacks without any prior knowledge. [PERSON] et al. [23] established a new attribute that can efficiently identify anomalous events using clustering, which allows us to construct label information for individual data points called estimated samples while preserving the local neighborhood information of the connections' features by using the Laplacian eigenmap technique. [PERSON] et al. [24] proposed two techniques, an Error Rate Based Concept Drift Detection and Data Distribution Based Concept Drift Detection, and investigated their effects. In addition, a sliding window-based data collection and drift analysis combined with K-Means Clustering has been used to reduce the amount of data size and improve the training datasets. We have used the Support Vector Machine (SVM) classifier for anomaly detection, and retraining of the model was initiated based solely on statistical tests. [PERSON] et al. [25] proposed an abnormal traffic detection method, namely, D-PACK, which consists of a Convolutional Neural Network (CNN) and an unsupervised deep learning model (e.g., Autoencoder) that can automatically analyze the traffic patterns and filter abnormal traffic. The CNN module can automatically extract features from the original network data. [PERSON] et al. (2016) proposed a robust anomaly detection technique, Fuzzified Cuckoo-based Clustering Technique (F-CBCT), which is divided into two stages: the hybridization of Cuckoo Search Optimization and K-means clustering. The advantages and disadvantages of some of the above references are listed in Table 1.  
The two main parts of anomaly detection are model building and anomaly detection, with model building being the most important part of anomaly detection. The core idea of anomaly detection is to compare the new data pattern with the existing behavior. If the new data deviates from the existing behavior, it is classified as an anomaly. In the existing literature, the user model is generally defined as the Profile, which is an outline or overview of the normal behavioral characteristics.