# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 2 Related Works  
Anomaly detection is an important task in wireless network data evaluation and management, which helps to improve the intelligent management of the network and realize the optimal allocation of network resources. Network anomaly detection can be divided into four categories: statistics-based, time series-based, sketch-based, and machine learning-based network anomaly detection. The statistics and timeseries-based method is unsupervised and does not require labeling data, while the sketch and machine learning based method requires the detection system to train the detection model using labeling data, which is very time consuming but can achieve higher accuracy. In addition, the sketch-based method requires little memory in a fast and complex network environment, so it can store the characteristic information of network traffic in real time. Therefore, this paper applies the method based on Sketch for abnormal detections of network traffic. Statistics-based methods are well suited for anomaly detection. [PERSON] et al. [11] proposed a network anomaly detection method (PCSS) that combines principal component analysis (PCA) and a single-stage headless face detection (SSH) algorithm. It solves the problem that the existing detection methods cannot learn regarding the spatio-temporal characteristics of the data, the classification accuracy is no longer high, and the detection time and accuracy are easily affected by redundant data in the sample. [PERSON] et al. [12] proposed an abnormal network traffic detection framework, which makes use of principal component analysis (PCA) with feature extraction and dimensionality reduction as the main purpose and makes use of a bidirectional generative adversarial network (BiGAN) model to detect abnormal network traffic. [PERSON] et al. [13] propose a comprehensive entropy-based method for network traffic anomaly classification that protects in opposition to the deception of entropy detection capabilities through a novel protection mechanism. It analyzes changes in different entropy types and monitors the number of different elements in the feature distribution as a unique detection metric to achieve entropy deception protection mechanism. Then, based on multivariate analysis of entropy changes of multiple features and aggregation of complex feature combinations, an entropy-based anomaly classification rule is proposed, expanding the entropy-based anomaly detection method. [PERSON] et al. [14] propose an anomaly detection method based on dynamic Markov models. This method segments the sequence data using sliding windows. In the sliding window, the state of the data is defined by the value of the data, which creates a high-order Markov model with an appropriate order to balance the length of the memory attribute and keep up with the trend of the sequence. In addition, an anomaly replacement strategy is proposed to prevent the detected anomalies from affecting the model building and to maintain the continuity of anomaly detection. Strategies based on time series consist of autoregressive and moving average model (ARMA) regression, empirical mode decomposition (EMD) transform, wavelet transform [15; 16], instantaneous frequency analysis, etc. These methods are suitable for network traffic data processing, which can meet the quantification requirements in network traffic anomaly detection and flexibly use signal processing techniques. [PERSON] et al. [17] proposed a traffic anomaly detection algorithm for wireless sensor networks (WSNs) based on the improved autoregressive integrated moving average (ARIMA) model, and they improved the traditional time series ARIMA model to detect traffic in WSNs, make predictions, and make judgments about traffic anomalies. [PERSON] et al. [18] proposed a threshold model based on Fractional Autoregressive Integrated Moving Averages (FARIMA) to describe SCN traffic and detect anomalies. [PERSON] et al. [19] proposed a network traffic anomaly detection model MPTCP-EMD based on the Multipath TCP(MPTCP) network.