A Comparative Evaluation of the Boosting Algorithms for Network Attack Classification

Abstract

The security of information resources is an extremely critical problem. The network infrastructure that enables internet access, in particular, may be targeted by attackers from a variety of national and international locations, resulting in losses for institutions that utilize it. Anomaly detection systems, sometimes called Intrusion Detection Systems (IDSs), are designed to identify abnormalities in such networks. The success of IDSs, however, is limited by the algorithms and learning capacity used in the background. Because of the complex behavior of malicious entities, it is critical to adopt effective techniques that assure high performance while being time efficient. The success rate of the boosting algorithms in identifying malicious network traffic was studied in this study. The boosting approach, one of the most used Ensemble Learning techniques, is accepted as a way to cope with this challenge. In this work, Google Colab has been used to model well-known boosting algorithms. The AdaBoost, CatBoost, GradientBoost, LightGBM, and XGBoost models have been applied to the CICID2017 dataset. The performance of the classifiers has been evaluated with accuracy, precision, recall, f1-score, kappa value, ROC curve and AUC. As a result of the investigation, it was discovered that the XGBoost algorithm produced the greatest results in terms of f1-score, with 99.89 percent, and the AUC values were extremely near to 1, with 0.9989. LightGBM and GradientBoost models, on the other hand, have been shown to be less effective in detecting attack types with little data.

Distributed denial of service attacks classification system using features selection and ensemble techniques

“…Unlike other tree-based models, LightGBM constructs decision trees by growing the leaves first, rather than growing the levels from the root, which accelerates the training process. It uses gradient-based one-side sampling and exclusive feature bundling to separate out the data instances for finding optimal split points and deal with excessive features [42], [43].…”