Abstract:Aiming at the problems of insufficient utilization of data spatial-temporal characteristics and poor generalization ability of e traditional network traffic anomaly detection methods, a traffic anomaly detection method based on multi-head attention mechanism and spatial-temporal feature fusion is proposed. The convolutional neural network(CNN) is utilized for the extraction of the spatial local features presented within the traffic data. The multi-head attention mechanism is introduced to achieve multi-angle adaptive reweighting of key features through parallel computation of multiple attention heads, thus improving the sensitivity of the model to abnormal traffic. The re-weighted features are then input into the bidirectional long short-term memory network(BiLSTM) to mine the long-distance temporal dependencies in the traffic data. Finally, Softmax is used to classify and identify the traffic data. Experiments are carried out on the publicly available dataset NSL-KDD and CIC-IDS-2017 with a detection accuracy of 85.40% and 99.41%, respectively, which verifies the effectiveness of the method in the task of network traffic anomaly detection.