Improved Network Traffic Classification Using Ensemble Learning

Abstract

Despite the large number of research efforts that applied specific machine learning algorithms for network traffic classification, recent work has highlighted limitations and particularities of individual algorithms that make them more suitable to specific types of traffic and scenarios. As such, an important topic in this area is how to combine individual algorithms using meta-learning techniques in order to obtain more robust traffic classification metrics. This paper presents a comparative analysis among meta-learning approaches and individual classifiers to classify network traffic. We investigate and evaluate a range of meta-learning techniques, including Voting, Stacking, Bagging and Boosting. We then propose a new experimental analysis of different meta-learning techniques -also known as ensemble learners -and compare them with their own base classifiers when used individually. Finally, considering the emerging popularity of Neural Networks, we analyze this scenario using the Multi-layer Perceptron classifier. The experiments were performed with data provided by the UCI Machine Learning Repository. The best performance was obtained by an ensemble technique (Bagging), which obtained accuracy of 99.972% and false positive rate of 0.00018%.

Performance of Machine Learning-Based Multi-Model Voting Ensemble Methods for Network Threat Detection in Agriculture 4.0

“…In ML, ensemble classifiers are created by several single estimators (base estimators) that cooperate with each other based on certain training and classification methodologies [23]. Various scientific studies have found ensemble classifiers to provide several advantages over individual classifiers, leading in many cases to more robust classification metrics [24]. In this light, Imran et al [25] introduced an IDS based on the ensemble of prediction and learning mechanisms to improve abnormal detection accuracy in network environments.…”

Energy Theft in Smart Grids: A Survey on Data-Driven Attack Strategies and Detection Methods

“…It selects one base classifier and invokes it many times using several training samples. Boosting, in contrast to bagging learning, generates various basic classifiers through a procedure in which examples of data sets receive new weights in sequence [113].…”

Aprimorando a Detecção de Ataques Automáticos através de Decomposição Espectral de Pacotes de Rede

“…O flowtbag 3 é uma aplicac ¸ão que processa um arquivo de captura de pacotes de rede e extrai 40 características numéricas de fluxos identificados pela quíntupla [Guimarães et al 2020]. A maioria das propostas para a detecc ¸ão de intrusão [Viegas et al 2019, Pelloso et al 2018, Lobato et al 2017, Possebon et al 2019] é baseada em características de tráfegos de pacotes deste tipo. Entretanto, os tópicos de pesquisa em engenharia de características propõem abordagens alternativas para representac ¸ão de um tráfego de rede, como grafos, imagens e análises espectrais.…”