Improve the Application of XGBDT in Network Abnormal Traffic Detection

2021 IEEE International Conference on Emergency Science and Information Technology (ICESIT) Pub Date : 2021-11-22 DOI:10.1109/ICESIT53460.2021.9696640

Fang Binhao, Huang Hong, Zhou Ziyun

{"title":"Improve the Application of XGBDT in Network Abnormal Traffic Detection","authors":"Fang Binhao, Huang Hong, Zhou Ziyun","doi":"10.1109/ICESIT53460.2021.9696640","DOIUrl":null,"url":null,"abstract":"Detecting abnormal traffic in real life often requires analyzing massive data (high-dimensional data) and unbalanced data. Aiming at the above problems, an intrusion detection model (SMBR-XGBDT) based on the combination of SMOTE algorithm and Boruta algorithm with Extreme Gradient Boosting (XGBoost) algorithm is proposed. The experiment selected 14367 extremely unbalanced samples based on the CIRA-CIC-DoHBrw-2020 data set, and detected 4 categories: DOH, Non-DoH, Benign-DoH, Malicious-DoH, using decision tree algorithm, random forest Algorithm, XGBoost algorithm as a control. The experimental results show that the SMBR-XGBDT model is significantly better than the other three models. The precision, recall, and F1 scores of the overall test were 93%, 93 %, and 93 %, respectively, which verified the effectiveness of the method. The precision rates of DOH, Non-DoH, Benign-DoH, Malicious-DoH were 88%, 100%, 98%, and 87%, respectively, which verified the feasibility of the method to deal with unbalanced data.","PeriodicalId":164745,"journal":{"name":"2021 IEEE International Conference on Emergency Science and Information Technology (ICESIT)","volume":"2 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2021-11-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2021 IEEE International Conference on Emergency Science and Information Technology (ICESIT)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ICESIT53460.2021.9696640","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 0

Abstract

Detecting abnormal traffic in real life often requires analyzing massive data (high-dimensional data) and unbalanced data. Aiming at the above problems, an intrusion detection model (SMBR-XGBDT) based on the combination of SMOTE algorithm and Boruta algorithm with Extreme Gradient Boosting (XGBoost) algorithm is proposed. The experiment selected 14367 extremely unbalanced samples based on the CIRA-CIC-DoHBrw-2020 data set, and detected 4 categories: DOH, Non-DoH, Benign-DoH, Malicious-DoH, using decision tree algorithm, random forest Algorithm, XGBoost algorithm as a control. The experimental results show that the SMBR-XGBDT model is significantly better than the other three models. The precision, recall, and F1 scores of the overall test were 93%, 93 %, and 93 %, respectively, which verified the effectiveness of the method. The precision rates of DOH, Non-DoH, Benign-DoH, Malicious-DoH were 88%, 100%, 98%, and 87%, respectively, which verified the feasibility of the method to deal with unbalanced data.

查看原文本刊更多论文

改进XGBDT在网络异常流量检测中的应用

在现实生活中，检测异常流量往往需要分析海量数据(高维数据)和不平衡数据。针对上述问题，提出了一种基于SMOTE算法和Boruta算法结合极端梯度增强(XGBoost)算法的入侵检测模型(SMBR-XGBDT)。实验选取基于CIRA-CIC-DoHBrw-2020数据集的14367个极度不平衡样本，采用决策树算法、随机森林算法、XGBoost算法作为对照，检测DOH、Non-DoH、benigni - DOH、Malicious-DoH 4类。实验结果表明，SMBR-XGBDT模型明显优于其他三种模型。整体测试的准确率为93%，召回率为93%，F1得分为93%，验证了方法的有效性。DOH、Non-DoH、Benign-DoH、Malicious-DoH的准确率分别为88%、100%、98%和87%，验证了该方法处理不平衡数据的可行性。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2021 IEEE International Conference on Emergency Science and Information Technology (ICESIT)

自引率

0.00%

发文量