Multimodal Spatiotemporal Collaborative Approach for Network Traffic Anomaly Detection

Abstract

Network traffic, generated by network entities, carries information related to system status, network environment, business secrets, and user privacy. Network traffic analysis is a crucial tool for network management, planning, and security. Traditional network traffic anomaly detection methods often rely on statistical features derived from DPI (Deep Packet Inspection). However, with the increasing sophistication and diversification of network attacks, single-data-source-based methods are no longer sufficient for effective security protection. To address the challenges posed by emerging network attacks, this paper proposes a multimodal fusion anomaly detection method based on wavelet analysis features. The proposed method utilizes the time-frequency features derived from wavelet analysis as a shared characteristic across multiple modalities. Distinct feature extraction approaches are developed for each modality, tailored to their specific attributes. By integrating feature fusion attention mechanisms with time-frequency feature guidance strategies, the method facilitates interaction between time-frequency and multimodal features. Experimental validation on the CIC-IDS-2017 dataset demonstrates that the model achieves an accuracy of 99.9% and an F1 score of 99.8%.