# A Network Traffic Abnormal Detection Method: Sketch-Based Profile Evolution
## 2 Related Works
The main purpose of establishing the model is to \"digitize\" the profile by various methods so that the algorithm can process it. Numerous methods for modeling and migration computation have been proposed in the related literature, which can be broadly classified into three categories depending on the type of method: statistical-based method, Soft Computing (SC), and distance-based method. The statistical-based approach is based on whether the sample obeys the global distribution. The network data flow to be processed in anomaly detection varies in scale and level. Although some literatures can deal with real network traffic, they mainly take the network data of large networks as the analysis target. For example, with Campus LAN (2017), trans-Pacific backbone (2018), Abilene and GEANT networks, CER-NET (2018), etc., such anomaly detection mainly maintains the stable operation of large networks. The de  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **ML/EL Method** & **Advantages** & **Disadvantages** \\ \hline \multirow{3}{*}{PCSS ([PERSON] et al., 2016)} & \multirow{3}{*}{PCA, SSH} & Superior to other detection models in detection speed and accuracy & It cannot meet the detection requirements of new network abnormal traffic and has poor scalability. It may even be incorrectly classified as a training dataset. \\  & & & \\ \multirow{3}{*}{Framework ([PERSON] et al., 2016)} & \multirow{3}{*}{PCA, BiGAN} & Further enhance the performance of the BiGAN model & \multirow{3}{*}{Cannot improve the feature engineering by auto-generation of meaningful derived features and find ways to interpret anomaly score} \\  & & & More feasible for practical implementation and general use & \multirow{3}{*}{Unsupervised machine learning, with no training required; needs further research} \\  & & & Have better anomaly detection & \\ \multirow{3}{*}{ARIMA-based ([PERSON] et al., 2016)} & \multirow{3}{*}{ARIMA} & \multirow{3}{*}{Have better anomaly detection accuracy} & \multirow{3}{*}{Need to reduce the false alarm rate} \\  & & & Improve the robustness of & \\ \cline{1-1}  & & & MPTCP transport systems & \\ \cline{1-1}  & & & Maintain high accuracy without & \\ \cline{1-1}  & & & need for offline training & \\ \cline{1-1}  & & & The method performs better than & \\ \cline{1-1}  & & & some of the existing techniques & \\ \cline{1-1}  & & & Clustering-based label & \\ \cline{1-1}  & & & & \\ \cline{1-1}  & & & & based on clustering \\ \cline  
tected abnormal conditions are mostly related to a part of the network area, so it is difficult to obtain fine-grained abnormal behavior for a single user or IP address. Nowadays, the anomaly detection research tends to analyze anomalies for specific targets. SC corresponds to traditional computation, which seeks exact solutions to problems. However, in practical applications, some problems do not have exact solutions, or even if there are exact solutions, they involve a lot of computational cost. Therefore, finding a feasible solution within acceptable computational cost is the most important feature of soft computing. SC includes many intelligent computations related to artificial intelligence, such as genetic algorithms, ant colony algorithms, and neural networks. Therefore, soft computing is also a commonly used method to establish a Profile for network traffic. [PERSON] et al. [32] preprocess data to generate Digital Signature of Network Segment using Flow Analysis (DSNSF), and 1440 samples were selected, crossed, and replicated by a genetic algorithm to create a Traffic Profile to describe traffic behavior. [PERSON] et al. [33] improved the clustering algorithm and proposed the Linear Grouping Algorithm (LGA) to cluster the samples, and then combined it with the particle swarm optimization algorithm to optimize the resampling process and obtain more stable grouping results. This grouping result is used in the next step of Single-Hop Access Profile modeling.