Anomaly Traffic Detection in Edge with Multi-scale Aggregated Transformer
摘要
Anomaly traffic detection is a key technology to ensure Quality-of-Service (QoS) and information security in edge computing. However, the huge volume and high dimension of edge traffic cause significant difficulty to anomaly detection. Meanwhile, the wide application of traffic encryption and the high dynamics of edge environments increase the complexity of detecting anomaly traffic. To address these important challenges, we propose a novel anomaly traffic detection method in edge with Multi-scale Aggregated Transformer (MA-Former), which can achieve accurate anomaly traffic detection only with characteristics of payload length and inter-arrival time of data packets. First, the MA - Former adopts a hierarchical architecture and multi-scale time-sequence representation to realize the mapping between feature sequences to reduce data dimension. Next, the mapping vector is encoded based on the multi-head self-attention mechanism. Finally, the feature vectors of each layer are aggregated, and the anomaly traffic detection is completed by pooling and the Softmax classifier. Using real-world datasets of edge traffic, extensive experiments are conducted to verify the effectiveness of the proposed MA-Former. The results show that the MA-Former achieves higher classification accuracy of anomaly traffic and superior generalization ability for different traffic than other benchmark methods.