Approach to anomaly traffic detection in a local network

The research intends to solve the problem of the occupation of bandwidth of local network by abnormal traffic which affects normal user's network behaviors. Firstly, a new algorithm in this paper named danger-theory-based abnormal traffic detection was presented. Then an advanced ID3 algorithm was presented to classify the abnormal traffic. Finally a new model of anomaly traffic detection was built upon the two algorithms above and the detection results were integrated with firewall. The firewall limits the bandwidth based on different types of abnormal traffic. Experiments show the outstanding performance of the proposed approach in real-time property, high detection rate, and unsupervised learning.