XGBoost-LR: A method for network traffic anomaly detection

Abstract

With the rapid evolution of internet technology, individuals are facing increasingly severe network security challenges. Confronted with diverse and sophisticated network attacks, traditional methods for network attack detection often struggle to keep pace with these evolving threats, leading to problems such as low anomaly detection accuracy and high false alarm rates. After thoroughly reviewing domestic and international advances in network traffic anomaly detection, this paper introduces a machine learning-based approach, namely the extreme gradient boosting (XGBoost-LR) anomaly traffic detection method. Building on the XGBoost model, this method is designed to address the prevailing issue of low accuracy in current network traffic anomaly detection. Unlike conventional XGBoost+LR approaches that simply stack a single XGBoost model with LR, our method introduces three key innovations: (1) parallel training of multiple diversified XGBoost base classifiers on strategically partitioned data subsets to capture complementary feature representations; (2) a novel two-phase feature interaction mechanism, where base classifiers first learn high-level nonlinear patterns before LR performs fine-grained probabilistic calibration; and (3) dynamic sample re-weighting during ensemble to emphasize hard-to-detect attack categories. This architecture enables more comprehensive feature learning than single-model XGBoost+LR while maintaining computational efficiency. Through strategic dataset segmentation and sub-model parallelism, it effectively identifies malicious traffic, reducing training time and enhancing detection accuracy. Experimental results demonstrate that the proposed method successfully detects and recognizes network traffic anomalies. When compared with several conventional machine learning models using the F1 score, it achieves a modest but consistent improvement in anomaly traffic detection performance.