A study of detection of abnormal network traffic: A comparison of multiple algorithms

Abstract

AbstractThe detection of abnormal traffic in networks is of great value for maintaining network security. This article gives a brief introduction of abnormal traffic and compares the performance of three algorithms, the support vector domain description algorithm, the gradient boosting decision tree algorithm, and the extreme learning machine‐k‐nearest neighbor (ELM‐KNN) algorithm. Experiments were carried out on the NSL‐KDD dataset. It was found that the accuracies of the three algorithms were 0.8327, 0.8679, and 0.9468, the recall rates were 0.6764, 0.7236, and 0.8997, the F1‐scores were 0.7898, 0.8364, and 0.9578, and the false alarm rates were 0.3236, 0.2764, and 0.1003. The running time of the ELM‐KNN algorithm was far less than the other two algorithms. The experimental results verify the effectiveness of the ELM‐KNN algorithm in abnormal network traffic detection. The ELM‐KNN algorithm can be further promoted and applied in practice.