# Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF
## 3 Hybrid Algorithm UMAP-RF
### UMAP Dimensionality Reduction Algorithm  
The UMAP algorithm was created based on the theoretical framework structure of Riemannian geometry and algebraic topology [5] to reduce the dimensionality of high-dimensional data based on the conclusion that high-dimensional spaces map to low-dimensional similarities [24]. **Theorem 1**. : _In Euclidean space, mapping points in high-dimensional space to low-dimensional space, the points originally close are definitely still close in low-dimensional space, but the points originally far away have some probability of becoming close._  
Proof of Theorem 1.: In the process of mapping points in high-dimensional space to low-dimensional space, we need to use embedding to calculate the similarity using inner product operation. Suppose \(v\) is a \(k\)-dimensional embedding vector in high-dimensional space, and \(x\) is a randomly generated \(k\)-dimensional mapping vector. Then, we can use the inner product operation to map \(v\) to a one-dimensional space and obtain the value \(h(v)=v*x\). In the process of mapping, some distance information will be lost; therefore, some similar points will be misclassified, which will cause the points that are far from each other in the high-dimensional space to gather together in the low-dimensional space after mapping. \(\square\)  
Given a high-dimensional data point \(X=\{x_{1},\cdots,x_{n}\}\) and a low-dimensional data point \(Y=\{y_{1},\cdots,y_{n}\}\). Using the nearest neighbor algorithm, the set of \(k\) nearest neighbors of each \(x_{i}\) is obtained \(\{x_{i},\cdots,x_{i_{k}}\}\). Where \(x\) is a high-dimensional space, \(x_{i}\)\(\in\)\(x\), \(x_{i}\) denotes the \(i\)-th data in the high-dimensional space; then, using an exponential probability distribution, the high-dimensional topology can be expressed as follows. \[p_{ij}=\exp\left(\frac{-\text{max}\Big{(}0,d\Big{(}x_{i},x_{i_{j}}\Big{)}-\rho _{i}\Big{)}}{\sigma_{i}}\right) \tag{1}\]  
where \(\rho_{i}\) denotes the distance from point \(x_{i}\) to the first nearest neighbor data point, and \(\sigma_{i}\) denotes the diameter from point \(x_{i}\) to the first nearest neighbor data point. Additionally, note that this is not a symmetric function, so this function should be symmetrized with high-dimensional probability to avoid overcrowding of cluster representations, so that different clusters can be represented in the overlapping regions. \[p_{ij}=p_{i|j}+p_{j|i}-p_{i|j}p_{j|i} \tag{2}\]  
High-dimensional probabilistic symmetry is necessary because after UMAP combines the points with local metric changes, it may appear that the weights of the graph between node \(a\) and node \(b\) are not equal to the weights between node \(b\) and node \(a\), where \(p_{i|j}\) denotes the weight of the \(i\)-th point to the \(j\)-th point distance, and \(p_{j|i}\) denotes the weight of the \(j\)-th point to the \(i\)-th point distance. After establishing the topology in the high-dimensional spatial distribution, it is correspondingly necessary to establish the probability distribution in the low-dimensional space as well. \[q_{ij}=\Big{(}1+a\big{(}y_{i}-y_{j}\big{)}^{2b}\Big{)}^{-1} \tag{3}\]  
The curve cluster \(a(y_{i}-y_{j})^{2b}\) is used in formula (3) to model the low-dimensional distance probabilities, not exactly t-distributed, where the default hyperparameters \(a\approx 1.93\), \(b\approx 0.79\)[5]. The UMAP algorithm expects data points of the same kind to be as close together as possible in the low-dimensional space after dimensionality reduction, while data points of different kinds are as far away from each other as possible. Therefore, the following function is introduced. \[\text{Attractive}= p_{i|j}(X)\log(\frac{p_{i|j}(X)}{q_{i|j}(Y)}) \tag{4}\] \[\text{Repulsive}=(1-p_{i|j}(X))\log(\frac{1-p_{i|j}(X)}{1-q_{i|j }(Y)}) \tag{5}\]  
In formulas (4) and (5), \(p_{i|j}(X)\) is the weight of data points in the high-dimensional distribution, and \(q_{i|j}(Y)\) is the weight of data points in the low-dimensional distribution.