A novel feature engineering method for network anomaly detection

Network anomaly detection leverages machine learning and statistical methods to identify deviations from normal network behavior. However, existing approaches often struggle to detect various types of anomalies due to the rapidly changing nature of traffic patterns, which are influenced by factors such as time, environment, and demand, even when the data itself remains consistent. To address this challenge, we propose a novel feature engineering method called THA-RNCT, which integrates a Two-way Hybrid Analysis (THA) strategy with a Region-based Noisy Concatenation Transformation (RNCT) module. Specifically, the THA strategy combines statistical techniques with classifier analysis to reduce the computational load on the classifier while ranking the feature importance. Additionally, the RNCT module transforms one-dimensional traffic features into two-dimensional images, enabling a convolutional neural network model to achieve high accuracy in anomaly detection. Extensive experiments on CIC-IDS2018 dataset demonstrate that the proposed method not only achieves superior performance, but also has many advantages such as lightweight, holism, and strong anti-interference ability.