{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T16:30:29Z","timestamp":1783787429013,"version":"3.55.0"},"reference-count":23,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2020,3,6]],"date-time":"2020-03-06T00:00:00Z","timestamp":1583452800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Anomaly detection systems can accurately identify malicious network traffic, providing network security. With the development of internet technology, network attacks are becoming more and more sourced and complicated, making it difficult for traditional anomaly detection systems to effectively analyze and identify abnormal traffic. At present, deep neural network (DNN) technology achieved great results in terms of anomaly detection, and it can achieve automatic detection. However, there still exists misclassified traffic in the prediction results of deep neural networks, resulting in redundant alarm information. This paper designs a two-level anomaly detection system based on deep neural network and association analysis. We made a comprehensive evaluation of experiments using DNNs and other neural networks based on publicly available datasets. Through the experiments, we chose DNN-4 as an important part of our system, which has high precision and accuracy in identifying malicious traffic. The Apriori algorithm can mine rules between various discretized features and normal labels, which can be used to filter the classified traffic and reduce the false positive rate. Finally, we designed an intrusion detection system based on DNN-4 and association rules. We conducted experiments on the public training set NSL-KDD, which is considered as a modified dataset for the KDDCup 1999. The results show that our detection system has great precision in malicious traffic detection, and it achieves the effect of reducing the number of false alarms.<\/jats:p>","DOI":"10.3390\/s20051452","type":"journal-article","created":{"date-parts":[[2020,3,6]],"date-time":"2020-03-06T09:26:41Z","timestamp":1583486801000},"page":"1452","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":84,"title":["Malicious Network Traffic Detection Based on Deep Neural Networks and Association Analysis"],"prefix":"10.3390","volume":"20","author":[{"given":"Minghui","family":"Gao","sequence":"first","affiliation":[{"name":"China NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, China"},{"name":"Beijing Kedong Electric Power Control System Co., Ltd., Beijing 100192, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li","family":"Ma","sequence":"additional","affiliation":[{"name":"China NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, China"},{"name":"Beijing Kedong Electric Power Control System Co., Ltd., Beijing 100192, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Heng","family":"Liu","sequence":"additional","affiliation":[{"name":"Software College, Northeastern University, Shenyang 110169, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhijun","family":"Zhang","sequence":"additional","affiliation":[{"name":"China NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, China"},{"name":"Beijing Kedong Electric Power Control System Co., Ltd., Beijing 100192, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiyan","family":"Ning","sequence":"additional","affiliation":[{"name":"China NARI Group Corporation (State Grid Electronic Power Research Institute), Nanjing 211106, China"},{"name":"Beijing Kedong Electric Power Control System Co., Ltd., Beijing 100192, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jian","family":"Xu","sequence":"additional","affiliation":[{"name":"Software College, Northeastern University, Shenyang 110169, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2020,3,6]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"26","DOI":"10.1109\/65.283931","article-title":"Network intrusion detection","volume":"8","author":"Mukherjee","year":"1994","journal-title":"IEEE Netw."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","article-title":"Anomaly-based network intrusion detection: Techniques, systems and challenges","volume":"28","author":"Kim","year":"2009","journal-title":"Comput. Secur."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"484","DOI":"10.1016\/j.ins.2016.04.019","article-title":"Fuzziness based semi-supervised learning approach for intrusion detection system","volume":"378","author":"Ashfaq","year":"2017","journal-title":"Inf. Sci."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Sabeti, E., and Host-Madsen, A. (2019). Data Discovery and Anomaly Detection Using Atypicality for Real-Valued Data. Entropy, 21.","DOI":"10.3390\/e21030219"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Aloqaily, M., Otoum, S., Ridhawi, A.I., and Jararweh, Y. (2019). An intrusion detection system for connected vehicles in smart cities. Ad Hoc Netw., 90.","DOI":"10.1016\/j.adhoc.2019.02.001"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"2315","DOI":"10.1109\/JIOT.2017.2737479","article-title":"Motor Anomaly Detection for Unmanned Aerial Vehicles Using Reinforcement Learning","volume":"5","author":"Lu","year":"2018","journal-title":"IEEE Internet Things J."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Podgorelec, B., Turkanovic, M., and Karakatic, S. (2020). A Machine Learning-Based Method for Automated Blockchain Transaction Signing Including Personalized Anomaly Detection. Sensors, 20.","DOI":"10.3390\/s20010147"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Wang, J., Yang, Q., and Ren, D. (2009, January 18\u201319). An intrusion detection algorithm based on decision tree technology. Proceedings of the 2009 Asia-Pacific Conference on Information Processing, Shenzhen, China.","DOI":"10.1109\/APCIP.2009.218"},{"key":"ref_9","unstructured":"Farid, D.M., Harbi, N., and Rahman, M.Z. (2020, January 15). Combining Nave Bayes and Decision Tree for Adaptive Intrusion Detection. Available online: https:\/\/arxiv.org\/abs\/1005.4496."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"577","DOI":"10.1109\/TSMCB.2007.914695","article-title":"Adaboost-based algorithm for network intrusion detection","volume":"38","author":"Hu","year":"2008","journal-title":"IEEE Trans. Syst. Man Cybern. Part B (Cybern)"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Ektefa, M., Memar, S., Sidi, F., and Affendey, L.S. (2010, January 17\u201318). Intrusion detection using data mining techniques. Proceedings of the 2010 International Conference on Information Retrieval & Knowledge Management (CAMP), Shah Alam, Selangor, Malaysia.","DOI":"10.1109\/INFRKM.2010.5466919"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Panda, M., Abraham, A., and Patra, M.R. (2010, January 23\u201325). Discriminative multinomial naive bayes for network intrusion detection. Proceedings of the 2010 Sixth International Conference on Information Assurance and Security, Atlanta, GA, USA.","DOI":"10.1109\/ISIAS.2010.5604193"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.proeng.2012.01.827","article-title":"A hybrid intelligent approach for network intrusion detection","volume":"30","author":"Panda","year":"2012","journal-title":"Procedia Eng."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1016\/j.neucom.2018.01.092","article-title":"Computer vision and deep learning techniques for pedestrian detection and tracking: A survey","volume":"300","author":"Brunetti","year":"2018","journal-title":"Neurocomputing"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"4550","DOI":"10.1109\/TNNLS.2017.2766168","article-title":"Deep Learning in Microscopy Image Analysis: A Survey","volume":"29","author":"Xing","year":"2018","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Long, J., Shelhamer, E., and Darrell, T. (2015, January 7\u201312). Fully convolutional networks for semantic segmentation. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.","DOI":"10.1109\/CVPR.2015.7298965"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Le, T.T.H., Kim, Y., and Kim, H. (2019). Network Intrusion Detection Based on Novel Feature Selection Model and Various Recurrent Neural Networks. Appl. Sci., 9.","DOI":"10.3390\/app9071392"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Vinayakumar, R., Soman, K.P., and Poornachandran, P. (2017, January 13\u201316). Applying convolutional neural network for network intrusion detection. Proceedings of the 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Udupi, India.","DOI":"10.1109\/ICACCI.2017.8126009"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Vinayakumar, R., Soman, K.P., and Poornachandran, P. (2017, January 13\u201316). Evaluating effectiveness of shallow and deep networks to intrusion detection system. Proceedings of the 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Udupi, India.","DOI":"10.1109\/ICACCI.2017.8126018"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"4184196","DOI":"10.1155\/2017\/4184196","article-title":"Network Intrusion Detection through Stacking Dilated Convolutional Autoencoders","volume":"2017","author":"Yu","year":"2017","journal-title":"Secur. Commun. Netw."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"308","DOI":"10.1016\/j.future.2019.03.043","article-title":"A deep learning approach for proactive multi-cloud cooperative intrusion detection system","volume":"98","author":"Abusitta","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. (2009, January 8\u201310). A Detailed Analysis of the KDD CUP 99 Data Set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2020, January 31). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Available online: https:\/\/www.scitepress.org\/Papers\/2018\/66398\/66398.pdf.","DOI":"10.5220\/0006639801080116"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/5\/1452\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T09:04:48Z","timestamp":1760173488000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/5\/1452"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,3,6]]},"references-count":23,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2020,3]]}},"alternative-id":["s20051452"],"URL":"https:\/\/doi.org\/10.3390\/s20051452","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,3,6]]}}}