Interactive Anomaly Detection in Dynamic Communication Networks

Network flows are the basic components of Internet. Considering serious consequences abnormal flows, it is crucial to provide timely anomaly detection in dynamic communication networks. To obtain accurate results networks, supervision from experts highly demanded. However, high-quality ground truth we suffer two major problems: (1) limited labor resources : with latest domain knowledge much fewer than large number flows; and (2) xmlns:xlink="http://www.w3.org/1999/xlink">dynamic environment considering new patterns (i.e., attacks) continuously changing network structures, requires adaptively update parameters. tackle these problems, propose HADDN, a novel bandit framework for periodic-updated We formulate task as problem, where by interactions, offered human fraction flows. construct semi-parametric expected rewards optimize estimation flows’ abnormality limited interactions. Also, utilize feature-based clusters structural correlations make connections between historical improve both efficiency accuracy estimation. What’s more, implementations reward proposed HADDN theoretical proof. Experimental evaluations on public datasets demonstrate substantial improvement our approaches compared state-of-art methods.