# Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF
## 4 Experiment and Analysis
### Analysis of Binary Classification Experimental Results  
The confusion matrix derived from the hybrid algorithm UMAP-RF, isolated forest (IF) [27] and local outlier factor (LOF) [28] on a test set is shown in Figure 3. Based on the parameters in this result, several evaluation indices were experimentally calculated in anticipation of obtaining a comprehensive performance report of the algorithm. \begin{table}
\begin{tabular}{c c c} \hline \hline
**No.** & **Score** &
\begin{tabular}{c} **(n\_estimators,** \\ **max\_leaf\_nodes)** \\ \end{tabular} \\ \hline
1 & 83.7 & (800, 30) \\
2 & 86.2 & (1600, 40) \\
3 & 91.6 & (1000, 10) \\
4 & 77.5 & (500, 70) \\
5 & 81.1 & (2000, 20) \\
6 & 85.4 & (200, 10) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Scores of each hyperparameter group obtained by manual tuning. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & & \multicolumn{2}{c}{**Projections**} \\ \cline{3-4}  & & Attack & Normal \\ \hline
**Actual** & \begin{tabular}{c} Attack \\ Normal \\ \end{tabular} & \
\begin{tabular}{c} TP \\ FP \\ \end{tabular} &
\begin{tabular}{c} FN \\ TN \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Confusion matrix. In Figure 3, the upper left part of the confusion matrix shows the number of connection records correctly classified as attack class, and the upper right part shows the number of connection records of normal class. The lower left part shows the number of connection records incorrectly classified as attack class. The lower right part shows the number of connection records correctly classified as normal class. The accuracy rate of each algorithm can be calculated from formula (6), the regression rate of each algorithm can be calculated from formula (7), and the F1 score of each algorithm can be calculated from formula (8). Based on the confusion matrix plots of the above three algorithms, the AUC, accuracy, recall and F1 scores of the hybrid algorithm UMAP-RF hybrid, isolated forest algorithm and LOF algorithm are derived and compared, and the comparison of the experimental results is shown in Figure 4.  
As shown in Figure 4, the accuracy, recall and F1 score of the hybrid algorithm UMAP-RF based on binary classification experiments are significantly improved compared with other machine-learning algorithms, with an accuracy of 92.6%, a recall of 91% and an F1 score of 90.5%, demonstrating that the hybrid algorithm UMAP-RF has a better detection effect for distinguishing normal data from abnormal data. The ROC curves for the hybrid algorithm UMAP-RF, isolated forest algorithm and LOF algorithm are shown in Figure 5. The AUC value is the area under the ROC curve. The calculation shows that the AUC value for the hybrid algorithm UMAP-RF is 85%, the isolated forest algorithm is 54.4%, and the LOF algorithm is 52.7%. Based on the AUC values, it can be seen that the hybrid algorithm UMAP-RF performs significantly better compared to the isolated forest algorithm and the LOF algorithm. To demonstrate the effect of the hybrid algorithm UMAP-RF classifier more visually, a visualization study of the binary classification-based hybrid algorithm UMAP-RF classifier was conducted. As shown in Figure 6, the purple part represents normal network traffic data points, and the rosy part represents abnormal attack traffic data points. The purple data points are clustered together and separated from the rosy data points in the figure, which maximally restores the data structure after binary classification and demonstrates a better clustering effect for visualization and research. To demonstrate the applicability of the hybrid algorithm UMAP-RF in network attack traffic detection, the normal and abnormal data in the dataset of KDDCUP99 and NSLKDD were classified by the hybrid algorithm UMAP-RF, LOF algorithm and isolated forest algorithm in the experimental part. The accuracy, recall and F1 score obtained after classification were also compared, and the experimental results of different algorithms are shown in Figures 7 and 8.