A Novel Network Anomaly Detection Method based on Data Balancing and Recursive Feature Addition

• Published in: KSII transactions on Internet and information systems 2020-07, Vol.14 (7), p.3093-3115
• Main Authors: Liu, Xinqian, Ren, Jiadong, He, Haitao, Wang, Qian, Sun, Shengting
• Format: Article
• Language: Korean
• Subjects: data balancing; Network anomaly detection; parameters combination optimization; random forests; recursive feature addition
• ISSN: 1976-7277; 1976-7277

Network anomaly detection system plays an essential role in detecting network anomaly and ensuring network security. Anomaly detection system based machine learning has become an increasingly popular solution. However, due to the unbalance and high-dimension characteristics of network traffic, the existing methods unable to achieve the excellent performance of high accuracy and low false alarm rate. To address this problem, a new network anomaly detection method based on data balancing and recursive feature addition is proposed. Firstly, data balancing algorithm based on improved KNN outlier detection is designed to select part respective data on each category. Combination optimization about parameters of improved KNN outlier detection is implemented by genetic algorithm. Next, recursive feature addition algorithm based on correlation analysis is proposed to select effective features, in which a cross contingency test is utilized to analyze correlation and obtain a features subset with a strong correlation. Then, random forests model is as the classification model to detection anomaly. Finally, the proposed algorithm is evaluated on benchmark datasets KDD Cup 1999 and UNSW_NB15. The result illustrates the proposed strategies enhance accuracy and recall, and decrease the false alarm rate. Compared with other algorithms, this algorithm still achieves significant effects, especially recall in the small category.