# Research on Boruta-ET-Based Anomalous Traffic Detection Model

Authors: Hongyan He; Guoyan Huang; Bing Zhang; Lewei Qin
Journal: Security and Communication Networks
 (2022)

---

## Abstract

With the rapid development of networks, intrusion detection has received increasing attention. In order to solve the problems of large dimensionality of intrusion detection data, unbalanced data samples, and large dispersion of datasets, which seriously affect the classification performance, this study proposes an anomaly detection based on Boruta and extreme tree (Boruta-ET) model. First, the network traffic data are preprocessed, which includes data cleaning, numerical and normalization processes, as well as equalization of the attack categories for a small number of samples by random oversampling at the data level; second, the traffic features are dimensionality reduced using the Boruta-based algorithm. The goal of Boruta dimensionality reduction is to extract all the features related to the dependent variable with a global dimension and find the optimal subset of features containing the most information; finally, the optimal feature subset is used as the input parameters of the extreme tree (ET) algorithm model for training and testing. Experiments were conducted on the real network traffic dataset CICIDS2017, and by evaluating the classification performance of several different machine learning algorithms, the experimental results show that the Boruta-ET model has the best performance with an accuracy rate of 99.80%, which can effectively improve the detection rate and achieve an effective recall rate for attack types with a small number of samples.


---

## Body

## 1. Introduction

In recent years, as the Internet has continued to grow, it has been integrated into all areas of people’s daily lives, such as electronic communication, teaching, business, and entertainment. However, the massive expansion of the network has obviously led to an increase in network traffic data. As a result, this expansion has led to a number of security issues, such as a variety of known and unknown Internet attacks on network security. The need to develop network security has attracted a great deal of attention from industry and academia worldwide [1], and for this reason, the use of intrusion detection systems has become a necessary option for ensuring network security. Intrusion detection is an indispensable and very important line of defense in terms of security systems, which collects information from a number of critical nodes in a computer network security system, looks at the network for signs of violations of security policies and attacks, identifies threats in the network and generates alerts, thus providing protection against internal attacks, external attacks, and misuse of implementation. Network intrusion detection systems (IDSs) are tools commonly used to detect network intrusions by collecting data on the current operational state of the network and analyzing network traffic using system preprogrammed algorithms and historical experience [2].The study of intrusion detection has been the focus of national and international research scholars. Network traffic anomaly detection refers to the application of various anomaly detection techniques to analyze network traffic and detect network attacks in a timely manner. In order to achieve network anomaly detection and improve the accuracy of detection, various traditional and emerging techniques have been applied to network anomaly detection. Harish and Kumar [3] designed a fuzzy clustering-based network anomaly detection method. The method first eliminates duplicate samples from the sample set, based on which principal component analysis is applied to select the most discriminative features, and finally, a fuzzy C-means algorithm is used to cluster the network samples. Mazini et al. [4] designed a network anomaly detection system combining reliable artificial bee colony and AdaBoost algorithms, with the artificial ant colony algorithm for feature selection and the AdaBoost algorithm for feature evaluation and classification, and validated it on the NSL-KDD and ISCXID2012 datasets. The accuracy and detection rate of the method were improved compared to traditional algorithms. Basati and Faghih [5] proposed a novel lightweight architecture-parallel deep autoencoder (PDAE) that aims to construct nearest neighbor values and nearest neighbor information for each feature vector. The effectiveness of the proposed architecture was evaluated using the KDDCup99, UNSW-NB15, and CICIDS2017 datasets, and the evaluation results showed that the proposed model was effective in improving accuracy and performance. Zavrak and Iskefiyeli [6] proposed an anomaly detection model based on a variational autoencoder. The reconstruction error of the autoencoder is used as the anomaly score criterion to detect anomalies in network traffic. This model can only distinguish whether data traffic is intrusive or not and cannot detect specific types of intrusion attacks. Alkadi et al. [7] proposed a collaborative intrusion detection system based on a deep blockchain network, which is practical for identifying network traffic attacks on IoT networks. The study also focuses on privacy-preserving aspects by combining a trusted execution environment with blockchain technology for the purpose of providing confidentiality to smart contracts. The model was evaluated on the UNSW-NB15 dataset and the results showed that the system has high accuracy and detection rates when performing classification, especially for attacks that exploit cloud networks. Popoola et al. [8] proposed to reduce feature dimension through the encoding stage of long short-term memory autoencoder (LAE). By analyzing the association changes of the low-dimensional feature sets generated by LAE, in order to confirm the effectiveness of the method, a deep bidirectional long and short-term memory method (BLSTM) was used to achieve an improved classification accuracy of network traffic samples.From the above think-aloud work, we found that the combination of feature selection and intrusion detection is a successful approach, as feature selection can assist in selecting the optimal subset of features with the most information and the least number of features from the entire feature set. When the distribution of class samples is unbalanced, it can affect the performance of the classification algorithm and thus reduce the detection rate, especially for a small number of classes. In network traffic, intrusions are much less common than normal behavior. Aiming at the problem of class imbalance in network intrusion traffic data, this study uses random oversampling to balance the data. Inspired by existing research, the use of feature selection and integrated classifiers has been highly successful in network traffic analysis and intrusion attack detection. We have designed the Boruta-ET model to address the problem of low accuracy and high false alarm rates, thus improving the efficiency of anomalous traffic detection.The rest of the study is organized as follows: the second section describes the overall framework of the study and the sources of the experimental data. The third section specifies the key techniques studied in this study. The fourth section conducts various experimental validation studies and evaluates the model approach. The fifth section concludes the whole study as well as future perspectives.


## 2. Overall Architecture and Data Sources

### 2.1. Overall Architecture

In this section, the model proposed in this study, Boruta-ET, will be described in detail. The flowchart of this model is shown in Figure1. First, the raw network traffic data are preprocessed, which includes data cleaning, character numerical normalization of the network traffic, and slicing of the network traffic dataset. Second, the Boruta [9] feature selection is performed on the training set of the network traffic data, and then the selected feature subsets are counted and the training set is randomly oversampled to expand the attack types of a small number of samples for the purpose of balancing the dataset. Finally, the optimal feature subset is used as the input data for the ET algorithm model for training, and the performance of the model is evaluated using the testing dataset data to obtain the final classification results of the model.Figure 1
Flowchart of the Boruta-ET model framework.


### 2.2. Data Sources

The CICIDS2017 [10] dataset used in this study was published by the Canadian Cyber Security Institute, which spans eight different files, and a short description of all of them is listed in Table 1. The CICIDS2017 dataset is the largest intrusion detection dataset currently available on the Internet, and the dataset contains 11 of the most important features, namely, attack diversity, available protocols, complete captures, metadata, complete interactions, heterogeneity, complete network configurations, feature sets, complete traffic, anonymity, and tagging [11]. In addition, it contains necessary and newer examples of attacks such as botnets, distributed DoS (DDoS), port scanning, and SQL injection [12]. In the previous publicly available dataset, there were fewer types of traffic, less capacity, various anonymous traffic packets, and payloads of information, and also there were many limitations on the various types of traffic attacks. However, However, the CICIDS2017 dataset has overcome the problems mentioned above, and the dataset contains various protocols such as FTP, HTTP, SSH, HTTPS, and e-mail that are not available in the previous dataset. The dataset has a total of 2830743 tagged network flows, each with 79 characteristics, which are distributed in 8 files, including SYN flag count, stream duration, destination port, etc.Table 1
CICIDS2017 dataset file description.
Name of filesAttacksDay activityMonday-WorkingHours.pcap_ISCX.csvBenign (normal human activities)MondayTuesday-WorkingHours.pcap_ISCX.csvBenign, FTP-patator, SSH-patatorTuesdayWednesday-WorkingHours.pcap_ISCX.csvBenign, DoS GoldenEye, DoS hulk, DoS slowhttptest, DoS slowloris, HeartbleedWednesdayThursday-WorkingHours-Morning-WebAttacks.pcap_ ISCX.csvBenign, web attack—brute force, web attack—Sql injection, web attack—XSSThursdayThursday-WorkingHours-afternoon-infilteration.pcap_ ISCX.csvBenign, infiltrationThursdayFriday-WorkingHours-morning.pcap_ISCX.csvBenign, botFridayFriday-WorkingHours-Afternoon-PortScan.pcap_ISCX.csvBenign, port scanFridayFriday-WorkingHours-afternoon-DDos.pcap_ISCX.csvBenign, DDoSFriday


## 2.1. Overall Architecture

In this section, the model proposed in this study, Boruta-ET, will be described in detail. The flowchart of this model is shown in Figure1. First, the raw network traffic data are preprocessed, which includes data cleaning, character numerical normalization of the network traffic, and slicing of the network traffic dataset. Second, the Boruta [9] feature selection is performed on the training set of the network traffic data, and then the selected feature subsets are counted and the training set is randomly oversampled to expand the attack types of a small number of samples for the purpose of balancing the dataset. Finally, the optimal feature subset is used as the input data for the ET algorithm model for training, and the performance of the model is evaluated using the testing dataset data to obtain the final classification results of the model.Figure 1
Flowchart of the Boruta-ET model framework.


## 2.2. Data Sources

The CICIDS2017 [10] dataset used in this study was published by the Canadian Cyber Security Institute, which spans eight different files, and a short description of all of them is listed in Table 1. The CICIDS2017 dataset is the largest intrusion detection dataset currently available on the Internet, and the dataset contains 11 of the most important features, namely, attack diversity, available protocols, complete captures, metadata, complete interactions, heterogeneity, complete network configurations, feature sets, complete traffic, anonymity, and tagging [11]. In addition, it contains necessary and newer examples of attacks such as botnets, distributed DoS (DDoS), port scanning, and SQL injection [12]. In the previous publicly available dataset, there were fewer types of traffic, less capacity, various anonymous traffic packets, and payloads of information, and also there were many limitations on the various types of traffic attacks. However, However, the CICIDS2017 dataset has overcome the problems mentioned above, and the dataset contains various protocols such as FTP, HTTP, SSH, HTTPS, and e-mail that are not available in the previous dataset. The dataset has a total of 2830743 tagged network flows, each with 79 characteristics, which are distributed in 8 files, including SYN flag count, stream duration, destination port, etc.Table 1
CICIDS2017 dataset file description.
Name of filesAttacksDay activityMonday-WorkingHours.pcap_ISCX.csvBenign (normal human activities)MondayTuesday-WorkingHours.pcap_ISCX.csvBenign, FTP-patator, SSH-patatorTuesdayWednesday-WorkingHours.pcap_ISCX.csvBenign, DoS GoldenEye, DoS hulk, DoS slowhttptest, DoS slowloris, HeartbleedWednesdayThursday-WorkingHours-Morning-WebAttacks.pcap_ ISCX.csvBenign, web attack—brute force, web attack—Sql injection, web attack—XSSThursdayThursday-WorkingHours-afternoon-infilteration.pcap_ ISCX.csvBenign, infiltrationThursdayFriday-WorkingHours-morning.pcap_ISCX.csvBenign, botFridayFriday-WorkingHours-Afternoon-PortScan.pcap_ISCX.csvBenign, port scanFridayFriday-WorkingHours-afternoon-DDos.pcap_ISCX.csvBenign, DDoSFriday


## 3. Methodology

### 3.1. Boruta Feature Selection

Boruta aims to select the set of all features that are relevant to the dependent variable and is a wrapper algorithm that uses a random forest as a classifier to filter out the features that are relevant to the dependent variable across all features to construct a new subset of features, primarily by reducing the average precision value. The Boruta algorithm obtains the importance of all features in the dataset with respect to the target variable, selects the important features, removes the redundant ones, and features a black box predictive model with good predictive accuracy to obtain the importance indicators associated with the target variable. The flowchart of the Boruta algorithm is shown in Figure2.Figure 2
Boruta algorithm flowchart.Boruta’s algorithm consists of the following steps:(1)
The individual features of the feature matrixX are shuffled, and the original features are spliced with the shuffled features to construct a new feature matrix, that is, a matrix with two times the number of features.(2)
Randomly disrupt the added attributes to remove their correlation with the response.(3)
Run a random forest classifier on the expanded feature matrix, using the newly constructed feature matrix as the input of the classifier, and the feature_importance of each feature can be output through the training of the model.(4)
Calculate theZ_Score for original features and shadow features.The importance score in Boruta’s algorithm is defined based on the out-of-bag error of the RF model and is given by the following equation:(1)MSEOOB=yi−y^iOOB2N.Here,MSEOOB is the out-of-bag error of the random forest, yi is the sample value, and y^iOOB is the predicted value of the out-of-bag sample of the sample yi.(2)Z_Score=MSEOOB¯SDMSEOOB.Here,Z_Score is the z-score, MSEOOB¯ is the mean of the out-of-bag error, and SDMSEOOB is the standard deviation of the out-of-bag error.(5)
Find the maximumZ_Score in the shadow features matrix, which is S_max, and use S_max as the screening index.(6)
Original features with Z_Score higher than S_max are regarded as “important” and reserved. Original features with Z_score lower than S_max are considered “unimportant” and permanently removed from the feature set.(7)
Repeat this process until all features are assigned importance.


### 3.2. Extreme Trees

Extreme trees are an integrated learning prediction method based on decision trees. The extreme tree algorithm is based on the traditional top-down approach of building a series of unpruned decision trees. It has two main features: first, each decision tree is built using the full training sample; second, each decision tree completes the node splitting by choosing the splitting threshold completely randomly. Algorithm1 is the limit random tree algorithm pseudocode.Algorithm 1: Extreme trees.
Build_an_extra_tree_ensembleDInput: Train setD=x1,y1,x2,y2,…,xm,ymOutput: Extreme TreesT=t1,t2,…,tM(1)
fori = 1 to M do(2)
Generating decision trees,ti=Build_an_extra_treeD(3)
Return Extreme Trees T(4)
end forBuild_an_extra_tree(D)Input: Train dataD=x1,y1,x2,y2,…,xm,ymOutput: Decision Tree t(1)
ifD<nmin or all candidate attributes in D are constant or output variables in D are constant then(2)
Return a leaf node(3)
else(4)
Randomly select K attributes from all candidate attributesa1,a2,…,ak(5)
Generate K split thresholdsd1,,d2,…,dk, Among them di=Pick_a_random_splitD,ai(6)
According toScored∗,D=maxi=1,2,…,KScoredi,D, Selecting the best test split threshold d∗(7)
According to test split thresholdsd∗, Divide the sample set D into two sub-sample sets Dl and Dr(8)
Construct a left subtreetl=Build_an_extra_treeDl and a right subtree tr=Build_an_extra_treeDr using subsets Dl and Dr respectively(9)
Create a tree node based ond∗, with tl and tr as its left and right subtrees respectively, and return a decision tree t(10)
end ifPick_a_random_splitD,aInput: Train dataD=x1,y1,x2,y2,…,xm,ym, Attributes aOutput: Divided attributes(1)
Calculate the minimum and maximum values of attribute a in the training setD, denoted respectively as aminD and amaxD(2)
Select a random splitting attributeac from aminD,amaxD(3)
Return to Split attributesa<ac


### 3.3. Evaluation Metrics

In order to verify the performance of each algorithm, the experiments in this study mainly use precision, recall, F1, and accuracy (Acc) as the evaluation metrics for anomaly detection effectiveness [13]. When conducting a multicategory classification anomaly detection study, we mainly use recall as the evaluation metric. It is not a good description of the performance of the classifier because the accuracy is high for categories with many data samples and low for categories with few data samples but still gives a high overall accuracy. The confusion matrix of classification results is listed in Table 2.Table 2
Confusion matrix of classification results.
Predicted valueBenignAttackIndicatorTrue valueBenignTPFNRecall=TP/TP+FNAttackFPTNPrecision=TP/TP+FPF1=2/1/precision+1/recallAcc=TP+TN/TP+TN+FP+FN


## 3.1. Boruta Feature Selection

Boruta aims to select the set of all features that are relevant to the dependent variable and is a wrapper algorithm that uses a random forest as a classifier to filter out the features that are relevant to the dependent variable across all features to construct a new subset of features, primarily by reducing the average precision value. The Boruta algorithm obtains the importance of all features in the dataset with respect to the target variable, selects the important features, removes the redundant ones, and features a black box predictive model with good predictive accuracy to obtain the importance indicators associated with the target variable. The flowchart of the Boruta algorithm is shown in Figure2.Figure 2
Boruta algorithm flowchart.Boruta’s algorithm consists of the following steps:(1)
The individual features of the feature matrixX are shuffled, and the original features are spliced with the shuffled features to construct a new feature matrix, that is, a matrix with two times the number of features.(2)
Randomly disrupt the added attributes to remove their correlation with the response.(3)
Run a random forest classifier on the expanded feature matrix, using the newly constructed feature matrix as the input of the classifier, and the feature_importance of each feature can be output through the training of the model.(4)
Calculate theZ_Score for original features and shadow features.The importance score in Boruta’s algorithm is defined based on the out-of-bag error of the RF model and is given by the following equation:(1)MSEOOB=yi−y^iOOB2N.Here,MSEOOB is the out-of-bag error of the random forest, yi is the sample value, and y^iOOB is the predicted value of the out-of-bag sample of the sample yi.(2)Z_Score=MSEOOB¯SDMSEOOB.Here,Z_Score is the z-score, MSEOOB¯ is the mean of the out-of-bag error, and SDMSEOOB is the standard deviation of the out-of-bag error.(5)
Find the maximumZ_Score in the shadow features matrix, which is S_max, and use S_max as the screening index.(6)
Original features with Z_Score higher than S_max are regarded as “important” and reserved. Original features with Z_score lower than S_max are considered “unimportant” and permanently removed from the feature set.(7)
Repeat this process until all features are assigned importance.


## 3.2. Extreme Trees

Extreme trees are an integrated learning prediction method based on decision trees. The extreme tree algorithm is based on the traditional top-down approach of building a series of unpruned decision trees. It has two main features: first, each decision tree is built using the full training sample; second, each decision tree completes the node splitting by choosing the splitting threshold completely randomly. Algorithm1 is the limit random tree algorithm pseudocode.Algorithm 1: Extreme trees.
Build_an_extra_tree_ensembleDInput: Train setD=x1,y1,x2,y2,…,xm,ymOutput: Extreme TreesT=t1,t2,…,tM(1)
fori = 1 to M do(2)
Generating decision trees,ti=Build_an_extra_treeD(3)
Return Extreme Trees T(4)
end forBuild_an_extra_tree(D)Input: Train dataD=x1,y1,x2,y2,…,xm,ymOutput: Decision Tree t(1)
ifD<nmin or all candidate attributes in D are constant or output variables in D are constant then(2)
Return a leaf node(3)
else(4)
Randomly select K attributes from all candidate attributesa1,a2,…,ak(5)
Generate K split thresholdsd1,,d2,…,dk, Among them di=Pick_a_random_splitD,ai(6)
According toScored∗,D=maxi=1,2,…,KScoredi,D, Selecting the best test split threshold d∗(7)
According to test split thresholdsd∗, Divide the sample set D into two sub-sample sets Dl and Dr(8)
Construct a left subtreetl=Build_an_extra_treeDl and a right subtree tr=Build_an_extra_treeDr using subsets Dl and Dr respectively(9)
Create a tree node based ond∗, with tl and tr as its left and right subtrees respectively, and return a decision tree t(10)
end ifPick_a_random_splitD,aInput: Train dataD=x1,y1,x2,y2,…,xm,ym, Attributes aOutput: Divided attributes(1)
Calculate the minimum and maximum values of attribute a in the training setD, denoted respectively as aminD and amaxD(2)
Select a random splitting attributeac from aminD,amaxD(3)
Return to Split attributesa<ac


## 3.3. Evaluation Metrics

In order to verify the performance of each algorithm, the experiments in this study mainly use precision, recall, F1, and accuracy (Acc) as the evaluation metrics for anomaly detection effectiveness [13]. When conducting a multicategory classification anomaly detection study, we mainly use recall as the evaluation metric. It is not a good description of the performance of the classifier because the accuracy is high for categories with many data samples and low for categories with few data samples but still gives a high overall accuracy. The confusion matrix of classification results is listed in Table 2.Table 2
Confusion matrix of classification results.
Predicted valueBenignAttackIndicatorTrue valueBenignTPFNRecall=TP/TP+FNAttackFPTNPrecision=TP/TP+FPF1=2/1/precision+1/recallAcc=TP+TN/TP+TN+FP+FN


## 4. Experimental Results and Analysis

### 4.1. Experimental Environment

The algorithm in the study is implemented in Python language. The operating system used for the experiments is Windows 10, 64 bit. The hardware environment is an Inter(R) Core (TM) i5-7200U CPU@ 2.50 GHz with 8G RAM.


### 4.2. Dataset Processing

In this study, the 14 attack types are divided into 6 domains, namely, DoS, PortScan, Bot, Brute Force, Web Attack, and Infiltration, and the detailed division is listed in Table3. By counting the number of each attack domain, this study uses a pie chart to visualize the overall distribution of the data, as shown in Figure 3.Table 3
Distribution of classes in the CICIDS2017 dataset.
Traffic typeNew labelLabelNo. of instancesBenign0Benign2273097DoS1DDoS128027Slowlowris5796Slowhttptest5499Hulk231073GoldenEye10293Heartbleed11Port scan2PortScan158930Bot3Bot1966Brute force4FTP7938SSH5897Web attack5Brute Force1507XSS652SQLInjection21Infiltration6Infiltration36Total——2830743Figure 3
The overall distribution of the CICIDS2017 dataset.


#### 4.2.1. Dataset Cleaning

The rows in the CICIDS dataset where the NaN and Inf values were located were removed. The number of samples after deletion is listed in Table4.Table 4
Number of CICIDS2017 data before and after cleaning.
Before cleaning (original)After cleaning022730972271313138069937974821589301588043196619564138351383252180218063636


#### 4.2.2. Numerical Characters

The dataset was marked with “benign” as “0” and the six attack types were marked as “1–6,” as in the new label column in Table3.


#### 4.2.3. Data Normalization

In order to reduce the problem of inconsistent impact weights between different dimensions of the data, this study uses a min-max normalization method to normalize the traffic data. The aim is to perform a linear transformation on the original data so that the results fall into the interval [0, 1]. The conversion function for the min-max normalization method is as follows:(3)X+=X−XminXmax−Xmin.Here,Xmin is the minimum value of all the sample data and Xmax is the maximum value of all the sample data. X is the original sample data before conversion. X+ is the data after the conversion [14].


### 4.3. Feature Selection Results

To facilitate experimental validation, the CICIDS2017 dataset is divided into a training dataset and a testing dataset in the ratio of 7 : 3 in this study. The number of training and test sets after the division is listed in Table5. The statistics on the dataset in Table 5 show that the number of the three attack types “bot,” “network attack,” and “infiltration” is relatively small compared to the other attack types. In order to avoid unbalanced distribution of samples, which would affect the performance of the classification algorithm and thus degrade the detection, we used random oversampling to rebalance the dataset. The three types of attack types with a small number of samples were randomly replicated, then the dataset obtained from each random sampling was superimposed by setting the “Sample_strategy” parameter to the specified number, and we expanded the number by another 5000, thus obtaining a new balanced dataset, and the number of the extended training set is listed in Table 5.Table 5
Distribution of the training and testing sets after random oversampling.
LabelTraffic typeTrain dataExpand train dataTest data0Benign158982115898216814921DoS2658872658871138612Port scan111254111254475503Bot195669566034Brute force9633963341995Web attack218071806466Infiltration36503610In this study, by using the Boruta algorithm feature selection, the Borutapy software wrapper package in the python language was used to perform 100 iterations by filtering the features related to the dependent variable, and finally 59 features were selected. The selected feature names are shown in Figure4.Figure 4
Display the names of the features selected by Boruta algorithm.


### 4.4. Classification Performance Evaluation

To validate the model Boruta-ET proposed in this study, we compared Boruta-ET with five other machine learning algorithms in terms of three metrics: precision, recall, and F1 value, and the results are listed in Table6. We can see from the metrics in the table that our proposed model has a slightly lower recall when detecting Bot attack types, but the overall performance is excellent. We also conducted experiments on deep neural networks (DNNs) and the results show that the results are not as good as our proposed model. We also compared the overall accuracy of the model with published literature, and as can be seen from the accuracy rates in Table 7, the model in this study achieves an accuracy rate of 99.8%, which is the highest accuracy rate and the highest detection rate compared to other models proposed in the literature. In order to demonstrate the high performance of the method proposed in this study more visually, we use bar charts for this purpose. This is shown in Figure 5. In summary, the feasibility of the model proposed in this study for the detection of abnormal traffic is also very efficient.Table 6
The performance of the methods in the study.
MethodBenignDoSPort scanBotBrute forceWeb attackInfiltrationNBPrecision0.870.810.760000.01Recall0.980.5800000.70F10.920.6800000.02LGBMPrecision0.880.610.8300.080.100Recall0.900.640.1400.030.710F10.890.140.2300.050.180DTPrecision0.990.990.990.410.950.660.17Recall10.9410.630.880.931F10.990.97100.500.910.770.29XgboostPrecision0.950.9910.4110.990.24Recall10.930.460.250.460.861F10.970.960.630.310.630.920.38RFPrecision0.96110.550.990.991Recall10.940.560.260.770.891F10.980.970.710.350.870.941DNNPrecision0.920.850.9800.9800Recall0.970.770.5000.5300F10.950.810.6600.6900The method proposed Boruta-ETPrecision110.990.8710.981Recall1110.260.980.951F11110.400.990.971Table 7
Comparison of the accuracy of the model proposed in this study with other algorithms.
AuthorMethodAcc (%)Ahmim et al. [15]Rep + RF96.67Wang [16]PCA + SVM92.91Ustebay et al. [17]AutoEncoder + DNN96.71Di and Li [18]SVM + DBN92.56Zhang et al. [19]Confidence + DNN93.80Other comparison algorithms in this articleNB86.24LGBM82.09DT98.87Xgboost95.58RF96.44DNN92.02The method proposed in this articleBoruta-ET99.80Figure 5
Comparison of the accuracy of the method proposed in this study with other methods.


## 4.1. Experimental Environment

The algorithm in the study is implemented in Python language. The operating system used for the experiments is Windows 10, 64 bit. The hardware environment is an Inter(R) Core (TM) i5-7200U CPU@ 2.50 GHz with 8G RAM.


## 4.2. Dataset Processing

In this study, the 14 attack types are divided into 6 domains, namely, DoS, PortScan, Bot, Brute Force, Web Attack, and Infiltration, and the detailed division is listed in Table3. By counting the number of each attack domain, this study uses a pie chart to visualize the overall distribution of the data, as shown in Figure 3.Table 3
Distribution of classes in the CICIDS2017 dataset.
Traffic typeNew labelLabelNo. of instancesBenign0Benign2273097DoS1DDoS128027Slowlowris5796Slowhttptest5499Hulk231073GoldenEye10293Heartbleed11Port scan2PortScan158930Bot3Bot1966Brute force4FTP7938SSH5897Web attack5Brute Force1507XSS652SQLInjection21Infiltration6Infiltration36Total——2830743Figure 3
The overall distribution of the CICIDS2017 dataset.


### 4.2.1. Dataset Cleaning

The rows in the CICIDS dataset where the NaN and Inf values were located were removed. The number of samples after deletion is listed in Table4.Table 4
Number of CICIDS2017 data before and after cleaning.
Before cleaning (original)After cleaning022730972271313138069937974821589301588043196619564138351383252180218063636


### 4.2.2. Numerical Characters

The dataset was marked with “benign” as “0” and the six attack types were marked as “1–6,” as in the new label column in Table3.


### 4.2.3. Data Normalization

In order to reduce the problem of inconsistent impact weights between different dimensions of the data, this study uses a min-max normalization method to normalize the traffic data. The aim is to perform a linear transformation on the original data so that the results fall into the interval [0, 1]. The conversion function for the min-max normalization method is as follows:(3)X+=X−XminXmax−Xmin.Here,Xmin is the minimum value of all the sample data and Xmax is the maximum value of all the sample data. X is the original sample data before conversion. X+ is the data after the conversion [14].


## 4.2.1. Dataset Cleaning

The rows in the CICIDS dataset where the NaN and Inf values were located were removed. The number of samples after deletion is listed in Table4.Table 4
Number of CICIDS2017 data before and after cleaning.
Before cleaning (original)After cleaning022730972271313138069937974821589301588043196619564138351383252180218063636


## 4.2.2. Numerical Characters

The dataset was marked with “benign” as “0” and the six attack types were marked as “1–6,” as in the new label column in Table3.


## 4.2.3. Data Normalization

In order to reduce the problem of inconsistent impact weights between different dimensions of the data, this study uses a min-max normalization method to normalize the traffic data. The aim is to perform a linear transformation on the original data so that the results fall into the interval [0, 1]. The conversion function for the min-max normalization method is as follows:(3)X+=X−XminXmax−Xmin.Here,Xmin is the minimum value of all the sample data and Xmax is the maximum value of all the sample data. X is the original sample data before conversion. X+ is the data after the conversion [14].


## 4.3. Feature Selection Results

To facilitate experimental validation, the CICIDS2017 dataset is divided into a training dataset and a testing dataset in the ratio of 7 : 3 in this study. The number of training and test sets after the division is listed in Table5. The statistics on the dataset in Table 5 show that the number of the three attack types “bot,” “network attack,” and “infiltration” is relatively small compared to the other attack types. In order to avoid unbalanced distribution of samples, which would affect the performance of the classification algorithm and thus degrade the detection, we used random oversampling to rebalance the dataset. The three types of attack types with a small number of samples were randomly replicated, then the dataset obtained from each random sampling was superimposed by setting the “Sample_strategy” parameter to the specified number, and we expanded the number by another 5000, thus obtaining a new balanced dataset, and the number of the extended training set is listed in Table 5.Table 5
Distribution of the training and testing sets after random oversampling.
LabelTraffic typeTrain dataExpand train dataTest data0Benign158982115898216814921DoS2658872658871138612Port scan111254111254475503Bot195669566034Brute force9633963341995Web attack218071806466Infiltration36503610In this study, by using the Boruta algorithm feature selection, the Borutapy software wrapper package in the python language was used to perform 100 iterations by filtering the features related to the dependent variable, and finally 59 features were selected. The selected feature names are shown in Figure4.Figure 4
Display the names of the features selected by Boruta algorithm.


## 4.4. Classification Performance Evaluation

To validate the model Boruta-ET proposed in this study, we compared Boruta-ET with five other machine learning algorithms in terms of three metrics: precision, recall, and F1 value, and the results are listed in Table6. We can see from the metrics in the table that our proposed model has a slightly lower recall when detecting Bot attack types, but the overall performance is excellent. We also conducted experiments on deep neural networks (DNNs) and the results show that the results are not as good as our proposed model. We also compared the overall accuracy of the model with published literature, and as can be seen from the accuracy rates in Table 7, the model in this study achieves an accuracy rate of 99.8%, which is the highest accuracy rate and the highest detection rate compared to other models proposed in the literature. In order to demonstrate the high performance of the method proposed in this study more visually, we use bar charts for this purpose. This is shown in Figure 5. In summary, the feasibility of the model proposed in this study for the detection of abnormal traffic is also very efficient.Table 6
The performance of the methods in the study.
MethodBenignDoSPort scanBotBrute forceWeb attackInfiltrationNBPrecision0.870.810.760000.01Recall0.980.5800000.70F10.920.6800000.02LGBMPrecision0.880.610.8300.080.100Recall0.900.640.1400.030.710F10.890.140.2300.050.180DTPrecision0.990.990.990.410.950.660.17Recall10.9410.630.880.931F10.990.97100.500.910.770.29XgboostPrecision0.950.9910.4110.990.24Recall10.930.460.250.460.861F10.970.960.630.310.630.920.38RFPrecision0.96110.550.990.991Recall10.940.560.260.770.891F10.980.970.710.350.870.941DNNPrecision0.920.850.9800.9800Recall0.970.770.5000.5300F10.950.810.6600.6900The method proposed Boruta-ETPrecision110.990.8710.981Recall1110.260.980.951F11110.400.990.971Table 7
Comparison of the accuracy of the model proposed in this study with other algorithms.
AuthorMethodAcc (%)Ahmim et al. [15]Rep + RF96.67Wang [16]PCA + SVM92.91Ustebay et al. [17]AutoEncoder + DNN96.71Di and Li [18]SVM + DBN92.56Zhang et al. [19]Confidence + DNN93.80Other comparison algorithms in this articleNB86.24LGBM82.09DT98.87Xgboost95.58RF96.44DNN92.02The method proposed in this articleBoruta-ET99.80Figure 5
Comparison of the accuracy of the method proposed in this study with other methods.


## 5. Conclusion and Future Work

Through the analysis of the current state of research on network traffic anomaly detection technology, the problem of high traffic feature dimensionality is very common and a key issue that has attracted attention; however, not all features have a positive correlation on the results of anomaly detection, and many useless and redundant features not only increase the computational complexity of traffic anomaly detection but also have a significant impact on the accuracy of detection. Boruta algorithm’s aim is to select all feature sets associated with the dependent variable, as opposed to the traditional minimization of feature sets using a model-specific cost function. Boruta algorithm enables a global view of the impact of the dependent variable, leading to an increase in the efficiency of feature selection. In this study, we use a randomly oversampled balanced dataset, which can make the information learned by the model too specific and not general enough. We used the CICIDS2017 dataset to evaluate and compare existing models under similar experimental conditions. The model outperformed other existing methods in terms of accuracy, false positives, and recall. The results show that the model can be used effectively for intrusion detection, improving the accuracy of intrusion detection and the ability to identify the type of intrusion.This study uses a random oversampling method to equalize the number of samples, and other sampling methods such as smote oversampling, undersampling, and hybrid sampling methods will be considered for experimentation in future research. The Boruta algorithm is very comprehensive in terms of feature selection to find relevant features, but it is also expensive to train as it has to extend the dataset, is computationally expensive, and cannot be reduced by parallelization. In future research, the use of GUP acceleration will be considered to reduce the training time of the model. In future research, we plan to extend this work by deploying the experimental results to corresponding software systems to observe the performance of the software in real network environments.



---

*Source: 9169266-2022-11-22.xml*