# Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF
## 4 Experiment and Analysis
### Analysis of Multi-Classification Experimental Results  
To evaluate the hybrid algorithm UMAP-RF in the multi-classification task of network attack traffic detection, the results of the control experiments are used for comparative analysis, and the algorithms used in the control experiments are the K-Means clustering algorithm [29], mini batch K-Means algorithm [30] and LSTM [31] neural network algorithm. The confusion matrix derived from the hybrid algorithm UMAP-RF and the algorithm used in the control experiment is shown in Figure 8. Based on the parameters in this result, several evaluation metrics were calculated for the experiment, and since the AUC metric does not apply to the multi-classification task, only the accuracy, recall and F1 score were used as evaluation metrics for the experiment in the expectation of obtaining a comprehensive performance report of the algorithm.  
Figure 9 shows the multi-classification confusion matrix for the K-Means algorithm, mini batch K-Means algorithm, LSTM algorithm and hybrid algorithm UMAP-RF. The multi-classification confusion matrix is calculated in the same way as the binary confusion matrix. The accuracy rate, regression rate and F1 score of each attack type are calculated from formulas (6)-(8). The multi-classification metrics of each algorithm can be obtained by averaging the metrics of all attack types.  
Figure 9: The confusion matrix by four different algorithms. (**a**) K-Means algorithm. (**b**) Mini Batch K-Means algorithm. (**c**) LSTM algorithm. (**d**) UMAP-RF algorithm.  
Based on the confusion matrix plots of the above four algorithms, the accuracy, recall and F1 scores of the hybrid algorithms UMAP-R and K-Means algorithm, mini batch K-Means algorithm and LSTM neural network algorithm are derived and compared, and the experimental results are shown in Figure 10.  
As can be seen from Figure 10, the accuracy, recall and F1 score of the hybrid algorithm UMAP-RF based on abnormal data classification are significantly improved compared with other machine-learning algorithms, with an accuracy of 81.6%, a recall of 80% and an F1 score of 80%, respectively, demonstrating that the hybrid algorithm UMAP-RF still has a better detection effect for the differentiation of anomalous data.  
To demonstrate the effect of the hybrid algorithm UMAP-RF classifier more visually, the hybrid algorithm classifier based on multi-classification of abnormal data was visualized by the UMAP algorithm. As shown in Figure 11, the color bar on the right of the figure denotes different attack types with different colors. The data points of the same attack type are clustered together in the figure, while data points of different attack types are separated from each other, which maximally restores the data structure after multi-classification and demonstrates a better clustering effect to make it convenient for visualization research.  
The experimental comparison and analysis results above show that the hybrid algorithm UMAP-RF is also effective for multi-classification of abnormal data.  
Figure 11: Visualization of multi-classification effect based on hybrid algorithm UMAP-RF.  
Figure 10: Histogram comparing the results of the multi-classification experiment.