The invention discloses a network traffic
anomaly detection method based on a small amount of
annotation data, and the method comprises the steps: carrying out the dimension reduction of a
feature vector through employing double auto-encoders, and then carrying out the
supervised training through employing a deep neural network; dividing the network traffic into two types of positive samples and negative samples, and finally screening out a part of important samples in unlabeled data and submitting the samples to experts for labeling, increasing the number of labeled samples, iteratively updating an auto-
encoder and a classifier, and then employing the trained classifier for detecting network traffic
abnormality. According to the invention, a double-auto-
encoder architecture is proposed, pure positive and negative samples are used for respectively training the auto-encoders, and the stability of the classifier is improved. Meanwhile, the
loss function of the deep neural network is improved, the
sample weight is adjusted in a finer-grained manner, the problem of
overfitting caused by imbalance of positive and negative samples and small training sets is solved, a new method for calculating the marking value of the unmarked data is provided, the samples with high marking value are selected to be delivered to experts, and the marking cost is reduced.