Abstract:

The current challenge in computer network traffic anomaly detection is the lack of labeled information, while users must select appropriate technologies and adjust parameters without any labels for cross-validation. To address this issue, this paper proposed an abductive learning-based anomaly traffic detection (ABL-ATD) model, which operated in an unsupervised manner. This model automatically generated pseudo-labels and utilized deductive reasoning and consistency verification to produce high-quality labels, thereby avoiding manual intervention. The innovation of ABL-ATD lied in its ability to extract effective signals from multiple unsupervised anomaly detection models and reliably distinguish between anomalous and normal traffic through validation and correction. Experimental results demonstrate that this model exhibits accuracy comparable to that of supervised learning models trained with real labels across multiple datasets.

Key words: traffic anomaly detection, unsupervised learning, abductive learning