With the rapid growth of network traffic, data has become increasingly complex and voluminous, posing significant challenges for accurate anomaly detection. Traditional deep learning approaches often fail to capture the rich interdependencies and heterogeneous nature of traffic features, limiting their effectiveness in identifying subtle or evolving abnormal patterns. To address these challenges, this paper proposes GS-HF (GraphSAGE with heterogeneous features), an anomaly detection framework. The method integrates both statistical and image-like features extracted from raw traffic data to capture multi-dimensional characteristics, and then constructs a graph based on the fused heterogeneous features to better represent relationships among traffic flows. An improved GraphSAGE model is applied for detection, incorporating Focal Loss to handle class imbalance in real-world anomaly datasets. Extensive experiments on multiple network traffic datasets demonstrate that GS-HF achieves superior detection performance compared to existing methods, highlighting its robustness and effectiveness in handling diverse and complex traffic patterns.

Due to the growth and popularity of the internet, cyber security remains, and will continue, to be an important issue. There are many network traffic classification methods or malware identification approaches that have been proposed to solve this problem. However, the existing methods are not well suited to help security experts effectively solve this challenge due to their low accuracy and high false positive rate. To this end, we employ a machine learning-based classification approach to identify malware. The approach extracts features from network traffic and reduces the dimensionality of the features, which can effectively improve the accuracy of identification. Furthermore, we propose an improved SVM algorithm for classifying the network traffic dubbed Optimized Facile Support Vector Machine (OFSVM). The OFSVM algorithm solves the problem that the original SVM algorithm is not satisfactory for classification from two aspects, i.e., parameter optimization and kernel function selection. Therefore, in this paper, we present an approach for identifying malware in network traffic, called Network Traffic Malware Identification (NTMI). To evaluate the effectiveness of the NTMI approach proposed in this paper, we collect four real network traffic datasets and use a publicly available dataset CAIDA for our experiments. Evaluation results suggest that the NTMI approach can lead to higher accuracy while achieving a lower false positive rate compared with other identification methods. On average, the NTMI approach achieves an accuracy of 92.5% and a false positive rate of 5.527%.

Adaptive Random Testing (ART) aims at improving detection effectiveness by evenly distributing test cases over the whole input domain. Many ART algorithms introducing clustering techniques (such as k-means Clustering) have been proposed to achieve an even spread of test cases. Though previous studies have demonstrated that ART with k-means clustering could achieve a good enhancement in testing effectiveness, k-means clustering is limited by the value of k, which will have a great impact on the test effectiveness. To improve the testing effectiveness of these techniques for object-oriented software, in this paper, we propose an approach named Determination Method of Optimal k-value based on the Experimental Process (DMOVk-EP) to determine the optimal k-value of k-means clustering and make the ART algorithms using k-means clustering technique achieve the best fault detection capability. The proposed method consists of two parts, one is a solution model for k based on the experimental process, and the other is an optimal k-value algorithm based on the presented model. We integrate this method with k-means clustering in ART and apply it to a set of open-source programs, with the experimental results showing that our approach obtains much more appropriate k, and also achieves much better testing effectiveness than other related methods.