Abstract: Traditonal network traffic anomaly detection is usually based on single original characteristic variable to judge the threshold value, or to judge the threshold value after the dimensionality reduction design statistics of multiple related variables.Although this kind of method is simple, it cannot cope with the nonlinear relationship between variables changing with time. In this paper, a deep neural network is designed for network traffic anomaly detection, which can dynamically identify the non-linear relationship between variables. Two layers of attention mechanism are introduced into Encoder-Decoder neural network, which improves the utilization of long-term historical information and realizes accurate estimation of the normal state of the network traffic. Based on the normal behavior of the estimated network traffic, the distribution of the residual error between the measured value and the estimated value is analyzed, the confidence interval is finally obtained and regarded as the control limit to distinguish abnormal behavior.

Key words: smart grid, network traffic anomaly detection, deep neural network, normal behavior model, confidence interval, control limit