Anomaly Classification Using Genetic Algorithm-Based Random Forest Modelfor Network Attack Detection  

作　　者：Adel Assiri 

机构地区：[1]Management Information Systems Department,College of Business,King Khalid University,Abha,61421,Saudi Arabia

出　　处：《Computers, Materials & Continua》2021年第1期767-778,共12页计算机、材料和连续体（英文）

摘　　要：Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks.Network-based intrusion detection systems(NIDSs)using machine learning(ML)methods are effective tools for protecting network infrastructures and services from unpredictable and unseen attacks.Among several ML methods,random forest(RF)is a robust method that can be used in ML-based network intrusion detection solutions.However,the minimum number of instances for each split and the number of trees in the forest are two key parameters of RF that can affect classification accuracy.Therefore,optimal parameter selection is a real problem in RF-based anomaly classification of intrusion detection systems.In this paper,we propose to use the genetic algorithm(GA)for selecting the appropriate values of these two parameters,optimizing the RF classifier and improving the classification accuracy of normal and abnormal network traffics.To validate the proposed GA-based RF model,a number of experiments is conducted on two public datasets and evaluated using a set of performance evaluation measures.In these experiments,the accuracy result is compared with the accuracies of baseline ML classifiers in the recent works.Experimental results reveal that the proposed model can avert the uncertainty in selection the values of RF’s parameters,improving the accuracy of anomaly classification in NIDSs without incurring excessive time.

关 键 词：Network-based intrusion detection system(NIDS) random forest classifier genetic algorithm KDD99 UNSW-NB15 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]