# A Deep Similarity Metric Method Based on Incomplete Data for Traffic Anomaly Detection in IoT
## 3 Methodology
### Deep Transfer Learning Method  
The goal of machine learning is to build a model as general as possible, so that the model can be well satisfied for different users, different devices, different environments and different requirements. However, the training and updating of machine learning models rely on data annotation. For our anomaly detection task, the most difficult is to continuously capture the abnormal events in the monitoring video, and labelling them manually in turn. Through the transfer learning method, we can find the similarity between annotated data and unannotated data, and then transfer the new model through knowledge reasoning. Fine-tuning in a deep neural network can help us save training time and improve learning accuracy, but it cannot deal with the different distribution of training data and test data. Deep neural network adaptation can make the data distribution of source domain and target domain closer, so that the classification accuracy of the network is better. Therefore, we propose a deep transfer learning method with two stages for our similarity metric network. Our model transfer learning method is mainly divided into two training stages. The first stage is shown in Figure 5a. \(A_{l}\) and \(A_{u}\) in the figure indicate the labeled anomalies and the unlabeled anomalies later acquired. According to [12], an adaptive layer set up before classification layer achieves a good transfer learning effect. The prediction layer in the figure is initialized with the fully connected layer from original ResNet. We implement an adaptive layer after the average pooling layer in order to prevent the model from overfitting to the distribution of the labeled anomalies. According to maximum \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Layer** & **Kernel Size** & **Stride** & **Feature Size** \\ \hline \multirow{4}{*}{Block1} & Input & - & - & \(224\times 224\times 3\) \\  & Conv1 & \(3\times 7\times 7\times 64\) & 2 & \(64\times 112\times 112\) \\  & Pool1 & \(3\times 3\) & 2 & \(64\times 56\times 56\) \\ \hline \multirow{4}{*}{Block1} & conv & \(64\times 3\times 3\times 64\) & 1 & \\  & conv & \(64\times 3\times 3\times 64\) & 1 & \\  & conv & \(64\times 3\times 3\times 64\) & 1 & \\  & conv & \(64\times 3\times 3\times 64\) & 1 & \\ \hline \multirow{4}{*}{Block2} & Att1 & \(64\times 3\times 3\times 1\) & 1 & \(56\times 56\times 1\) \\ \hline \multirow{4}{*}{Block3} & conv & \(64\times 3\times 3\times 128\) & 2 & \\  & conv & \(128\times 3\times 3\times 128\) & 1 & \\  & conv & \(128\times 3\times 3\times 128\) & 1 & \\ \hline \multirow{4}{*}{Block3} & conv & \(128\times 3\times 3\times 1\) & 1 & \(28\times 28\times 1\) \\  & conv & \(128\times 3\times 3\times 256\) & 2 & \\  & conv & \(256\times 3\times 3\times 256\) & 1 & \\  & conv & \(256\times 3\times 3\times 256\) & 1 & \\  & conv & \(256\times 3\times 3\times 256\) & 1 & \\ \hline \multirow{4}{*}{Att3} & \(256\times 3\times 3\times 1\) & 1 & \(14\times 14\times 1\) \\ \hline \multirow{4}{*}{Block4} & conv & \(256\times 3\times 3\times 512\) & 2 & \\  & conv & \(512\times 3\times 3\times 512\) & 1 & \\  & conv & \(512\times 3\times 3\times 512\) & 1 & \\ \hline \multirow{4}{*}{Att4} & \(512\times 3\times 3\times 1\) & 1 & \(7\times 7\times 1\) \\  & AvgPool & \(7\times 7\) & 1 & \(512\times 1\times 1\) \\ \cline{1-1} FC & \(1024\times 2\) & - & 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The parameters, kernel size, kernel stride and the feature dimensions of proposed model. mean discrepancy (MMD) criterion, we want to achieve the same distribution as far as possible after the features of the two branches are mapped through the adaptive layer. \(L_{mmd}\) is used to measure the approximate degree of the distribution of annotated and unannotated anomalies in a mini-batch. \(L_{cls}\) is the softmax with cross-entropy of the classification loss.