Problems such as a vanishing gradient and overfitting will occur when a recurrent neural network (RNN) is exploited to detect abnormal network traffic. In addition, some network traffic is unbalanced, which leads to low detection accuracy. Therefore, an unbalanced abnormal traffic detection method has been proposed. It is composed of the improved bidirectional residual gated recurrent unit (Res-BIGRU) and integrated dynamic extreme learning machine (IDELM). First, the candidate hidden state activation function of the GRU is changed into an unsaturated activation function. The residual connection is used to avoid the vanishing gradient. The purpose of alleviating network degradation is achieved, and the traffic features extracted are better. Second, an IDELM is proposed to solve the unbalanced classification. The minority samples are generated by the IDELM model. The set model in game theory is used to compute the combined weight, which improves the fitting effect. Third, two IDELMs are used to update the final classification results. Fourth, four network datasets and IoT datasets are used to verify the performance. The average accuracy on four network datasets is 91.11% when samples are unbalanced. Furthermore, it can be concluded that the improved Res-BIGRU and IDELM strategy is effective. Better classification results can be achieved when network traffic is unbalanced. In particular, the performance is better in unbalanced NSL-KDD datasets. The index values obtained are the best compared with other methods. It is also suitable for intrusion detection of the Internet of Things, which has good performance. The further advantage lies in that the robustness is better when there are other sample interferences.

当利用循环神经网络（RNN）检测异常网络流量时，会出现梯度消失和过度拟合等问题。此外，部分网络流量不均衡，导致检测精度低。因此，提出了一种不平衡异常流量检测方法。它由改进的双向残差门控循环单元（Res-BIGRU）和集成动态极限学习机（IDELM）组成。首先，将 GRU 的候选隐藏状态激活函数变为不饱和激活函数。残差连接用于避免梯度消失。达到缓解网络退化的目的，提取的流量特征较好。其次，提出了IDELM来解决不平衡分类。少数样本由 IDELM 模型生成。采用博弈论中的集合模型计算组合权重，提高拟合效果。第三，两个IDELMs用于更新最终的分类结果。第四，使用四个网络数据集和物联网数据集来验证性能。当样本不平衡时，四个网络数据集的平均准确率为 91.11%。此外，可以得出结论，改进的 Res-BIGRU 和 IDELM 策略是有效的。当网络流量不平衡时，可以获得更好的分类结果。特别是在不平衡的 NSL-KDD 数据集上性能更好。与其他方法相比，获得的指标值是最好的。也适用于物联网的入侵检测，具有良好的性能。