# Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF
## 2 Related Works  
Machine-learning-based network attack traffic detection has attracted the attention of many researchers engaged in the network security industry [9], especially the prevalent deep learning nowadays. Several researchers have introduced deep-learning models to network attack traffic detection and achieved good results. Ever since data mining was introduced in 1989, the application of data mining in network attack traffic detection systems has become the main research direction of network attack traffic detection technology. The U.S. Department of Defense Advanced Planning Agency (DARPA) created the DARPA 1998 dataset [10]. Subsequently, [PERSON] et al. divided this dataset into training data with markers and unmarked test data [11], named the KDDCUP99 dataset, and later, the NSL-KDD dataset originated from it. Since the birth of these datasets, machine-learning and later deep-learning techniques have been massively applied in the study of network attack traffic detection models. Currently, the primary methods applied in machine learning for network traffic attack detection include support vector machines (SVM) [12], decision trees [13], Bayesian [14] and artificial neural networks [15], etc. The NSL-KDD dataset cannot meet the current research needs in the field of intrusion detection due to its inherent shortcomings. [PERSON] et al. publishedthe UNSW-NB15 dataset. Compared with the KDDCUP99 and NSL-KDD datasets, the UNSW-NB15 dataset contains the most comprehensive attack scenarios. Researchers can detect malicious traffic by imitating the actual network environment based on this dataset, which promotes the development of network attack traffic detection research. More and more research on network traffic anomaly detection has been conducted at home and abroad in recent years. [PERSON]'s team proposed a K-Means algorithm-based clustering of typical network traffic in the UNSW-NB15 dataset [16], processed the extracted representative feature subsets with a feature recursive elimination algorithm and then designed nine algorithm combinations by combining three machine-learning algorithms: decision trees, random forest and XGBoost [17]. [PERSON] of Nanjing University of Posts and Telecommunications clustered some samples screened by the KNN algorithm with the DBSCAN algorithm [18]. The recall and F1 scores obtained by training on some features of the UNSW-NB15 dataset showed a significant improvement. [PERSON] of Xidian University designed a network intrusion detection system based on the light GBM model. The accuracy obtained by comparison and validation on the dataset UNSW-NB15 was 85.78% [19]. [PERSON] experimented with an improved SVM algorithm on the UNSW-NB15 dataset, and the accuracy obtained was 82% [20]. [PERSON] improved the test accuracy of the binary classification scheme from 88.13% to 90.85% by using the XGBoost-based feature selection method allowing DT and other ways [21]. [PERSON] proposed a network intrusion detection model incorporating a convolutional neural network and gated recursive units and obtained an accuracy of 86.25% after experiments on the UNSW-NB15 dataset, which was 1.95% higher than the same type of CNN-GRU [22]. [PERSON] tuned the parameters of the extreme learning machine (ELM) by an improved gray wolf optimization algorithm (GWO) to test the proposed method using the UNSW-NB15 dataset and experimentally obtained an accuracy rate of 81% [23]. However, these methods did not perform a good job in dimensionality reduction in the dataset. The training speed of traditional machine-learning algorithms will be significantly reduced when facing large network traffic. For such problems, the UMAP algorithm based on network traffic feature filtering can effectively handle high-dimensional network traffic data and make the characteristics of the reduced-dimensional network traffic data more pronounced. It has a speedy running time and processes the data with high computational efficiency.