Method for recognizing network data flow anomalies based on C2-GRU model
LIU Shuai
YANG Jinhui
OU Sicheng
SHI Xiaowei
JIANG Ming
Abstract：[Objective]With the continuous expansion of network scale and the evolving complexity of attack techniques,network traffic anomaly detection has become a critical link in ensuring network security and maintaining the stable operation of key information infrastructure.However,traditional machine learning methods generally face bottlenecks such as slow convergence and insufficient feature representation accuracy when handling complex network traffic feature extraction,which limits their effectiveness in practical anomaly detection scenarios.To address these challenges,an innovative spatiotemporal fusion deep learning model,C2-GRU,was proposed in this paper,which was based on a convolutional neural network(CNN)-enhanced learner with a gated recurrent unit(GRU).The proposed model aims to enhance the multi-dimensional detection performance for abnormal traffic.[Methods]A dual-fusion deep learning framework was designed,leveraging the strength of CNN in spatial feature extraction and the capability of GRU in temporal feature modeling.A C-GRU model was constructed to achieve preliminary spatiotemporal feature fusion.It was then cascaded with CNN to form the C2-GRU model,which extracted spatiotemporal features through dual parallel convolution operations.This approach effectively captured the multidimensional features of abnormal traffic in complex network environments.[Results]The experimental results demonstrate that the proposed model achieves optimal overall performance on the KDD99 dataset.Specifically,the fused model attains an accuracy of 99.89％and an area under curve(AUC)of 0.990 2,significantly outperforming individual CNN and GRU models.Furthermore,compared to traditional anomaly detection models,the proposed model not only achieves high recognition performance but also exhibits a relatively short model runtime,which highlights its superior engineering applicability.[Conclusion]The proposed C2-GRU hybrid model,employing a dual-convolution fusion strategy,effectively enhances spatiotemporal feature learning,suitable for abnormal traffic detection in complex network environments.It has dual advantages in anomaly recognition accuracy and computational efficiency,capable of offering technical support for securing key information infrastructure and mitigating the economic losses caused by network attacks.The model is of significant practical reference value for ensuring network information security.
Keywords：anomaly recognitiondeep learningconvolutional neural networkgated recurrent unitspatiotemporal fusionmachine learningtraffic detectiondata flow feature
Publication Date：2025-07-25
Online Publishing Date：2025-09-18(First online date of this platform, not the publication date of the document)
Pages：7( 486-492 )