# Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF
## 4 Experiment and Analysis
### Experimental Results of Dimensionality Reduction Algorithm  
The pre-processed data are imported into the PCA algorithm [25], T-SNE algorithm [26] and UMAP algorithm, all of which are commonly used in machine learning to process the dimensionality reduction in high-dimensional datasets. The visualization plots and running times of the three-dimensionality reduction algorithms are derived by experimental simulation, respectively. Figure 2 shows the data structure visualization after being processed by the dimensionality reduction algorithm PCA, T-SNE and UMAP, respectively. The purple color at the top of the color gradient bar on the right side of the figure to the eighth orange color from the top down are abnormal attack data. Different color blocks represent different types of \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**No.** & **Feature** & **No.** & **Feature** & **No.** & **Feature** & **No.** & **Feature** & **No.** & **Feature** \\ \hline
1 & srcip & 11 & dttl & 21 & stcpb & 31 & sintpkt & 41 & ct\_srv\_src \\
2 & sport & 12 & sloss & 22 & dtcpb & 32 & dintpkt & 42 & ct\_srv\_dst \\
3 & dstip & 13 & gloss & 23 & smensz & 33 & tcprt & 43 & ct\_dst\_ltm \\
4 & dsport & 14 & service & 24 & dmeansz & 34 & synack & 44 & ct\_src\_ltm \\
5 & proto & 15 & sload & 25 & trans\_depth & 35 & ackdat & 45 & ct\_src\_dport\_ltm \\
6 & state & 16 & dload & 26 & res\_bdy\_len & 36 & is\_sm\_ips\_ports & 46 & ct\_dst\_sport\_ltm \\
7 & dur & 17 & spkts & 27 & sjit & 37 & ct\_state\_ttl & 47 & ct\_dst\_src\_ltm \\
8 & syytes & 18 & dpkts & 28 & djit & 38 & ct\_fly\_http\_mthd & 48 & attack\_cat \\
9 & dbytes & 19 & swin & 29 & stime & 39 & is\_ftp\_login & 49 & label \\
10 & sttl & 20 & dwin & 30 & litme & 40 & ct\_ftp\_cmd & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: List of features in the UNSW-NB15 dataset. attacks, and the rosy color at the bottom is normal data. The more concentrated points of the same color and the more separate issues of different colors indicate the apparent effect of data clustering of each feature, thus reflecting the impact of dimensionality reduction algorithm clustering. The comparison from the figure shows that the UMAP algorithm has the best effect of dimensionality reduction on the dataset and effectively spreads out the data of different attack types. As shown in Figure 2, although the principal component analysis (PCA) method projects the high-dimensional data onto a two-dimensional plane after dimensionality reduction, all features are crowded together without bothering to distinguish normal data from abnormal data. Therefore, the principal component analysis (PCA) method is ineffective in dimensionality reduction for network attack traffic. As shown in Figure 3, T-SNE can further distinguish between normal and abnormal data and preserve the data structure after dimensionality reduction. However, T-SNE is not applicable to large samples and cannot achieve the preservation of the global structure. Compared with T-SNE, the UMAP algorithm can better reflect the high-dimensional data structure with better continuity. As shown in Figure 4, the distinction between normal and abnormal data is more obvious in the two-dimensional plane, while the global structure is better preserved after the dimensionality reduction. Figure 3: The confusion matrix by three different algorithms. (**a**) UMAP-RF algorithm. (**b**) LOF algorithm. (**c**) Isolation Forest algorithm. Figure 2: Visualization of data structure after dimensionality reduction by three different algorithms. (**a**) PCA algorithm. (**b**) T-SNE algorithm. (**c**) UMAP algorithm. This paper also compares the running time of three dimensionality reduction algorithms, as shown in Table 2. Principal component analysis (PCA) has the shortest running time and is much shorter than the other two methods, but it cannot show the relationship between the data after dimensionality reduction.