Abstract:With the application and development of Internet technology, network traffic is growing rapidly, and the situation of network security is becoming more and more serious. As an important way to protect network security, abnormal traffic detection has been paid more and more attention. In this paper, the uncertainty of the samples in the abnormal traffic detection dataset is studied. Combining the three-way decision idea with the random forest algorithm, a three-way selection random forest optimization model for abnormal traffic detection is proposed. Firstly, the three-way decision idea is integrated into the random selection process of feature attributes, and the attribute importance based on decision boundary entropy is calculated. The feature attributes are divided into the normal domain, abnormal domain, and uncertain domain, and the three-way attribute random selection rules are designed to randomly select the feature attributes that conform to the rules from different domains. Secondly, the classifier evaluation function is constructed by combining pure accuracy and diversity, and the anomaly traffic detection base classifier with a high evaluation value is selected for integration to eliminate the unstable factors caused by randomness in the process of base classifier generation. Thirdly, the optimal node weight combination of the base classifier is obtained by iterative calculation of the gray wolf optimization algorithm to further improve the prediction effect and robustness of the model. Finally, the model is applied to the abnormal traffic detection dataset. The experimental results show that the prediction accuracy of the three-way selection random forest optimization model on CIC-IDS2017, KDDCUP99, and NSLKDD datasets is 96.1%, 95.2%, and 95.3%, respectively, which has a better detection effect than other machine learning algorithms.

A Mallows-like Criterion for Anomaly Detection with Random Forest Implementation

An Anomaly Detection Method for Weighted Data Based on Feature Association Analysis

Self-Supervised Random Forest on Transformed Distribution for Anomaly Detection

Three-Way Selection Random Forest Optimization Model for Anomaly Traffic Detection

Weighted Isolation and Random Cut Forest Algorithms for Anomaly Detection

Isolation-Based Anomaly Detection

Performance Metric for Multiple Anomaly Score Distributions with Discrete Severity Levels

Early-Stage Anomaly Detection: A Study of Model Performance on Complete vs. Partial Flows

An Intrusion Detection Model Based on Improved Random Forests Algorithm

New hybrid ensemble method for anomaly detection in data science

Imputation-based Time-Series Anomaly Detection with Conditional Weight-Incremental Diffusion Models.

Anomaly Detection with Partially Observed Anomalies

An improved X-means and isolation forest based methodology for network traffic anomaly detection

Multivariate Time Series Anomaly Detection with Few Positive Samples

Fair Anomaly Detection For Imbalanced Groups

OptIForest: Optimal Isolation Forest for Anomaly Detection

Research of Anomaly detection based on Dynamic Anomaly Detection Enhancement Framework

An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series

An adaptive Laplacian weight random forest imputation for imbalance and mixed-type data

Title : Adaptive Anomaly Detection using Isolation Forest

Deep Optimal Isolation Forest with Genetic Algorithm for Anomaly Detection