Abstract: With the rapid development of network technology,network attacks have brought huge negative impacts,so network security issues need to be resolved urgently.Aiming at denial of service (DoS) attacks in networks,an anomaly detection method for isolated forest based on edge computing framework was proposed.According to the characteristics of each edge node,the method realizes the reasonable distribution of the model training tasks and effectively improves the utilization efficiency of edge nodes.Meanwhile,the characteristics of edge computing are utilized to realize the offloading of model training tasks from cloud center,so as to better reduce the time consumption of the system and reduce the burdenof the cloud center.In order to verify the effectiveness of the proposed method,the 10%-KDDCUP99 network dataset is preprocessed and partial data used for experiments.Experimental results show that compared with the Support Vector Machine (SVM) and Multi-Layer Perceptron (MLP) methods,time consumption of proposed method is reduced by 90% and 60% respectively,and area under curve (AUC) can reach more than 0.9,which indicates that the method can effectively reduce the system time consumption and ensure a high detection performance.

Key words: Anomaly detection, Data preprocessing, DoS attack, Edge computing, Isolation forest