# Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF
## 1 Introduction  
Since 2020, with Corona Virus Disease 2019 sweeping the world, people have had to work online, and most schools have adopted online classes to teach. Internet traffic has increased dramatically, and many unscrupulous individuals have used hacking techniques to create malicious traffic to interfere with the normal operation of network devices to profit from this period. Cyber threats have been ranked as one of the most critical threats to the world economy, with expected USD 133 billion cyber-security-related expenditure to date [1]. With the constant development and popularity of cyber security [2], cyber attack security detection systems are widely used to protect cyberspace and ensure that people can browse the web in a secure network environment. Network attack traffic detection has been one of the main methods to enhance network security in recent years [3], which monitors network traffic or suspicious activities in hosts and issues alerts when such activities are detected. Currently, network attack traffic detection is gradually moving toward intelligence, and research on strange traffic attacks based on machine learning or data mining [4] has yielded significant results. The network traffic in the current internet environment is growing, and the variety of malicious traffic is increasing. Traditional machine-learning methods are difficult to effectively detect network attack traffic and have low detection efficiency. To better handle the high-dimensional network security connection data and improve the efficiency of subsequent detection of abnormal data, we propose a hybrid algorithm--called uniform manifold approximation and projection algorithm-random forest (UMAP-RF)--for detection methods. First, large and complex network traffic is dimensionally reduced by using the uniform manifold approximation and projection algorithm (UMAP) [5], and then, an improved random forest (RF) is adopted for more accurate detection and classification. Compared with traditional machine-learning methods, the UMAP-RF hybrid algorithmgreatly reduces the detection time for network data with large and tedious data volume and improves the efficiency of network attack security detection. The characteristics of network connection data after dimensionality reduction are more pronounced, which further enhances the accuracy of differentiation based on normal data and abnormal data. This hybrid algorithm solves the problems of ineffective processing of high-dimensional data and low detection accuracy in the current research of network attack traffic detection technology, and it directly improves the accuracy and efficiency of network traffic attack detection. Moreover, this paper visualizes and analyzes the network traffic data after detection and classification, which visually verifies the effectiveness of the algorithm more intuitively. The dataset used in the experiments of this paper is UNSW-NB15 [6]. Compared with KDDCUP99 [7] and NSL-KDD [8], the dataset UNSW-NB15 has more attack types, can better simulate the network traffic on the internet nowadays and has a more practical reference value. To make the proposed solution more applicable in network attack traffic detection techniques, the KDDCUP99 and NSL-KDD datasets are used in the binary classification experimental part under the same experimental environment, and the experimental results show that the hybrid algorithm UMAP-RF still has excellent experimental results. The main contributions of this paper are as follows. Firstly, this paper uses the UMAP algorithm based on network traffic feature filtering for dimensionality reduction, so that the reduced network security connection data highlight the key feature information, which helps classify the normal and abnormal data. Additionally, the processing speed is very fast when facing a large amount of data, which directly improves the efficiency of network security attack detection.