Abstract: Network traffic anomaly detection based on deep learning usually has the problems of poor adaptability to real-world environments,limited representation ability and week generalization ability.From the perspective of these problems,a network traffic anomaly detection method based on multi-scale memory residual network is proposed.Based on the analysis of high-dimensional feature space distribution,this paper demon-strates the validity of the approach to network traffic data preprocessing.Combining multi-scale one-dimensional convolution and long short-term memory network,the representation ability is enhanced by deep learning classifiers.To make the network traffic anomaly detection accurate and efficient,by the idea of residual network,the deep feature extraction is implemented,the problems of vanishing/exploding gradients,the over-fitting and network degradation are prevented,and the convergence speed of the model is accelerated.The visualizations of data preprocessing result suggest that,compared with standardization,normalization has better capability to separate the abnormal traffic data from the normal traffic data.The result of validity verification and performance evaluation experiment reveal that,by inserting identity mapping,the convergence speed of the model can be accelerated,and the network degradation problem can be efficiently addressed.The result of contrast experiment indicates the one-dimensional convolution and long short-term memory network can reinforce the representation and generalization ability of our model,and the performance metrics of our model is better than that of the current deep learning model.

Key words: Long short-term memory network, Multi-scale memory residual network, Multi-scale one-dimensional convolution, Network intrusion detection, Network traffic anomaly detection, Residual network