Computer network traffic classification using data mining

In this work, we explore different data sets for Network Intrusion detection. Classify the attack signals from normal ones. With the increase in network connections, computer security and intrusion detection became a challenging problem. Our research used different feature selection techniques: Information gain, Gain ratio, Chi2, and Relief. We train different models based on ten thresholds with a quantization range of 10% to 90% for each feature selection algorithm we used. We train Decision trees, Random Forest, Extra trees, GradiantBoosing, XGBoost, AdaBoostm, Linear, SVM, and Logistic Regression. We use cross-validation and feature selection with different thresholds for each of these models. Then, we compare all of these models based on the validation accuracy obtained from cross-validation. The stacking model achieves 97.79% test accuracy on the UNSW-NB15 data set using only 15 features with Random Forest, Extra Trees, and XGBoost as base models (level-0 models) and Logistic Regression as a meta-classifier model. By changing the top model to MLP with 5 hidden layers we achieve 97.82% test accuracy, but the complexity of the stacking model is increased too much to improve the accuracy with only 0.03% this note should be considered when choosing the model for deployment which will affect the inference time of the stacking model.