Network traffic anomaly detection method based on stacked fusion time features

Abstract

The rapid growth of Network Traffic (NT) necessitates reliable anomaly detection to mitigate security threats and ensure system stability. An accurate NT prediction strategy is key in this process. However, current network traffic anomaly detection (NTAD) methods are limited in accuracy due to their inability to adequately balance the modeling of short-term and long-term temporal dependencies in network traffic. This paper proposes an NTAD method based on a Stacked Fusion Time Feature (SFTF) framework to overcome this limitation. Specifically, a stacked time feature encoder is first constructed to capture time-series patterns across multiple resolutions, generating hierarchical feature sequences. These sequences are then fed into a multi-timescale feature fusion module based on a temporal convolutional network to integrate local and global temporal features. In addition, an interquartile range-based detection mechanism is established to identify anomalies from the prediction results. Experiments are conducted on two representative datasets, Yahoo S5 and SMD. On Yahoo S5, SFTF achieves an average AUC of 0.9647 and an $F_1$ score of 0.9750; on SMD, SFTF attains an $F_1$ score of 0.9713, with precision and recall of 0.9803 and 0.9622, respectively. These results demonstrate that SFTF can effectively identify abnormal states and accurately locate network anomalies across datasets with different temporal characteristics. The proposed method offers a robust and accurate solution for NTAD in large-scale, low-latency environments, with promising applications in bandwidth optimization and cybersecurity.