Research on DoS Traffic Detection Model Based on Random Forest and Multilayer Perceptron

Abstract

Denial of service (DoS) attack is a typical and extremely destructive attack, which poses a serious threat to the Internet security and is highly concealed, making it difficult to detect. In response to this problem, the paper proposes an efficient DoS attack traffic detection method, Random Forest and Multilayer Perceptron hybrid network attack detection algorithm (RF-MLP). At first, it is adopted that the random forest algorithm can be used for feature selection and the optimal threshold can be determined by drawing a learning curve; therefore the optimal feature subset is determined. Then the optimal feature subset is used as the input of the multilayer perceptron for training. We will analyze the experimental results obtained using different configurations by varying the number of training neurons and the number of hidden layers of the multilayer perceptron network in order to improve the accuracy and reduce the number of false results. Using the real network traffic CICIDS2017 dataset and UNSW-NB15 dataset to evaluate the method in this paper, the results show that the model can effectively detect and classify DoS attacks, the accuracy rate can reach 99.83% and 93.51%, and there is also a significant reduction in the false alarm rate, verifying the effectiveness of the method and its ease of use.

Detection of DDoS Attack using Machine Learning Algorithms

“…Their research involved identifying attack groupings to distinguish attackers, resulting in a highly accurate MLP classification model with a 98.99% detection rate and a low false positive rate of 2.1%. The authors of [3], uses two datasets CICIDS2007 and UNSW-NB15. In this methodology Random Forest and MLP as a single model RF-MLP which analyses and evaluate the network traffic and establishes a security prediction model that accurately identifies DoS attack.…”

“…These attributes can be divided into two groups: categorical and numerical. The categorical attributes primarily consist of destination address, source address, and utilized protocols and the remaining features are numerical type which are analyzed based on various visualization methods as shown in below figures [3][4][5][6][7][8][9][10][11][12]. error-checked delivery of data between applications over a network.…”

Deep Neural Decision Forest (DNDF): A Novel Approach for Enhancing Intrusion Detection Systems in Network Traffic Analysis

“…Simple and ensemble models are the two main categories that can broadly classify ML-based models [10][11][12][13]. Ensemble models seek to integrate heterogeneous or homogeneous (often, classifiers) to produce a model that outperforms each of the individual models and overcomes the limits of each individual model [14][15][16]. More precisely, several alternative homogeneous ensemble frameworks, such as bagging (e.g., random forest (RF)) and boosting (e.g., XGBoost), have been presented, with the majority of them relying on the decision tree (DT) model [8,15,17].…”

Retracted: Research on DoS Traffic Detection Model Based on Random Forest and Multilayer Perceptron

“…Tis article has been retracted by Hindawi, as publisher, following an investigation undertaken by the publisher [1]. Tis investigation has uncovered evidence of systematic manipulation of the publication and peer-review process.…”