# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 3 Sketch-Based Profile Evolution for Network Traffic Abnormal Detection
### Network Spatiotemporal Feature Extraction Based on CNN-LSTM  
When detecting network traffic anomalies, transition anomaly detection is also required. The Sketch method is utilized to continuously extract TGs to obtain a set of TGs, and then uses this set of TGs to generate behavior models. Generated behavior models preprocess TGs in time and space to generate profiles through CNN and LSTM neural networks. Finally, the new data stream is processed by the transition method to realize the Profile Evolution. Use the Sketch method to continuously extract the TG map to obtain a set of TG maps, and then use this set of TG maps to generate a behavior model. However, to generate a behavior model, the TG map needs to be preprocessed in time and space through CNN and LSTM neural networks. The network data stream [48] is formed by the continuously generated data packet \(T_{f}=\left(p_{1},p_{2},\cdots,p_{i},\cdots\right)\) and the data packet \(T_{f}\) is converted into some characteristic fingerprint combinations \(F_{p}=\left(f_{1},f_{2},\cdots,f_{i},\cdots\right)\), and then the application fingerprint is mapped to the specified interval according to the Sketch-based method to generate a TG map:  
\[M_{i:n}= \begin{bmatrix}f_{1}^{1}&f_{2}^{1}&\cdots&f_{m}^{1}\\ f_{1}^{2}&f_{2}^{2}&\cdots&f_{m}^{2}\\ \vdots&\vdots&\ddots&\vdots\\ f_{1}^{1}&f_{2}^{2}&\cdots&f_{m}^{1}\\ \end{bmatrix}  \tag{2}\]  
Figure 3: Traffic graph mapping. The elements of the matrix are all represented by the length of the data packet. Figure 4 is a TG image represented by a gray scale image:  
According to the obtained behavioral TG map, CNN [49] is used to obtain the user's spatial features due to its excellent ability to extract features from images. Figure 5 is a structural diagram of a CNN. The main functional modules of the deep convolutional neural network CNN can be divided into two categories: a feature learning module and classification module. The feature learning module is mainly composed of a convolution layer and a pooling layer. The convolution layer performs a convolution operation on the obtained behavior TG to extract the features of the local area. This process uses a filter to analyze the image and extract the corresponding feature information. Assuming that the filter is a square matrix of order \(|w|\), let \(l=n\) in \(M_{l\times n}\), and \(\frac{l}{|w|}\) is the number of new features, \(w\) is the weight of the filter, and \(b\) is the bias vector, as shown in Equation (3):  
\[h_{i}=f(w\cdot M_{i,\frac{l}{|w|}}+b) \tag{3}\]  
Combine the generated new feature vectors, as showed in Equation (4):  
\[H=[h_{1},h_{2},\cdots,h_{\frac{l}{|w|}}] \tag{4}\]  
Pooling layers can reduce the number of parameters and reduce the possibility of over-fitting. Pooling functions include average pooling and max pooling. Here, the operation of maximum pooling on vector \(H\) generates a new feature vector, as shown in Equation (5):  
\[\widehat{H}=\text{max}\{H\} \tag{5}\]  
The network data stream generates a TG through the structured process of the Sketch summary method and then extracts the feature vector of the space through CNN. The data  
Figure 4: Traffic Graph Grayscale. Figure 5: Convolutional Neural Network. stream is continuously generated, and the user's behavior is also affected by the change in time. Therefore, the LSTM [50] recurrent neural network is used to extract temporal characteristics of the network data stream \(T_{f}\). The LSTM network has the characteristic that its current state is affected by the previous state, and it has the ability to choose to save or forget information. Its structure is shown in Figure 6, which is composed of three gates: Forget Gate \(f_{t}\), Input Gate \(i_{t}\), and Output Gate \(o_{t}\). \(C_{t}\) is the current state of the cell, \(h_{t}\) is the state of the hidden layer, and \(x_{t}\) is the input data. The Forget Gate is to selectively discard the historical information of the cell state.