A study of detection of abnormal network traffic: A comparison of multiple algorithms

Abstract

The detection of abnormal traffic in networks is of great value for maintaining network security. This article gives a brief introduction of abnormal traffic and compares the performance of three algorithms, the support vector domain description algorithm, the gradient boosting decision tree algorithm, and the extreme learning machine-k-nearest neighbor (ELM-KNN) algorithm. Experiments were carried out on the NSL-KDD dataset. It was found that the accuracies of the three algorithms were 0.8327, 0.8679, and 0.9468, the recall rates were 0.6764, 0.7236, and 0.8997, the F1-scores were 0.7898, 0.8364, and 0.9578, and the false alarm rates were 0.3236, 0.2764, and 0.1003. The running time of the ELM-KNN algorithm was far less than the other two algorithms. The experimental results verify the effectiveness of the ELM-KNN algorithm in abnormal network traffic detection. The ELM-KNN algorithm can be further promoted and applied in practice.