Research on Interactive Network Traffic Anomaly Detection Method with Advice Fusion

In modern networks facing increasing cyberattacks, the design of accurate and efficient methods for identifying and classifying anomalous traffic is of significant research value and practical importance. However, data-driven detection models often struggle to adapt to complex and dynamic network environments. Interactive learning can effectively improve the learning speed and convergence of algorithms by incorporating human feedback or advice into the learning process. In this paper, we propose an interactive network traffic anomaly detection method with advice fusion. It formulates the network traffic anomaly detection task as a Markov Decision Process and uses the Double Deep Q-Network algorithm to train the agent, where appropriate human advice is introduced into the procedure to accelerate model learning and convergence. Experiments on the NSL-KDD and AWID datasets demonstrate that the proposed method outperforms other learning-based approaches, particularly in detecting rare and hard-to-identify anomaly traffic types. Furthermore, we analyze the impact of different thresholds on human interventions and the model’s performance. The results show that as the threshold and the amount of human advice increase, the detection performance significantly improves.