# Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF
## 3 Hybrid Algorithm UMAP-RF
### Random Forest Algorithm Based on Parameter Optimization  
The random forest algorithm is a large-scale, high-dimensional data learning classifier integrated with multiple independent decision tree classifiers, each of which is obtained based on Bootstrap sampling. Then, multiple decision trees are combined to derive the final classification result by voting. The random forest algorithm is chosen to classify network traffic data because it can improve the training speed of large samples by high parallelization when dealing with the data volume of network security connection data. The process of constructing the random forest algorithm is as follows:  
1. Construct multiple sub-datasets. Form an intermediate dataset by selecting k samples through sampling with put-back from a dataset, including k samples, and then randomly select a few features among all features of this intermediate dataset as the final dataset;
2. Build a sub-decision tree based on the sub-dataset. Assume that a sub-dataset has M features. When each node of the decision tree needs to split, randomly select m features from these features (m < M), then select one of the m features as the splitting attribute of the node. Keep repeating this step until it can no longer be classified. The principle of judgement is that the attribute selected by a node next time is the attribute used in the last split;
3. Follow the above steps to construct a large number of sub-decision trees, which form a random forest;
4. Input the dataset into different sub-decision trees. Different judgments will be obtained. The most judgmental result is the classification result obtained by the random forest.  
Given the above description, the specific description of random forest algorithm is shown in Algorithm 2.  
```
For\(a=1\) to \(A\): (a) A boostrap sample \(Y\) of size \(X^{*}\) is randomly selected from the training set. (b) Grow a random-forest tree \(T_{a}\) to the boostrapped data, repeating the following steps recursively for each terminal node of the tree, guiding to the minimum node size \(x_{\min}\)  i. Select \(n\) variables at random from the \(q\) variables.  ii. Pick the best variable among the \(n\).  iii. Split the node into two child nodes. Output the ensemble of trees \(\{T_{a}\}_{1}^{A}\) To make a prediction at a new point \(h\): Classification: Let \(\widehat{C}_{a}(h)\) be the class prediction of the \(a\)th random-forest tree. Then, \(\widehat{C}_{\text{rf}}^{A}(h)=majority\)\(vote\left\{\widehat{C}_{a}(h)\right\}_{1}^{A}\).
```  
**Algorithm 2** Random Forest algorithm To further improve the effectiveness of the random forest algorithm for detecting malicious traffic in complex network traffic, this paper improves the random forest algorithm based on parameter optimization using base evaluators (n_estimators) and the maximum number of leaf nodes (max_leaf_nodes). Hyperparameters are very important for machine-learning algorithms because they directly control the behavior of the training algorithm and have an essential impact on the performance of machine-learning models.