An Accuracy Network Anomaly Detection Method Based on Ensemble Model

Abstract

Identifying network anomaly detection is important since they may carry critical information in circumstances such as a burst of intrusions, privacy theft, system damage and fraudulent activities. In recent years, there are many detection methods for network anomalies are proposed, however, a single model always faces the problems of over or under-fitting, high bias and variance. An improved method is to comprehensively use the results of multiple models and then reform the final predictions. This paper introduces an ensemble model, which is a powerful technique to increase accuracy on network anomaly detection. By combining three base models Xgboost, LightGBM and Catboost into one anomaly detector, we successfully detect different DDOS-smurf and Probing activities. This ensemble model is verified on ZYELL-NCTU net traffic, which is a large-scale dataset for read-world network anomaly detection. All code are open source in Github and can be directly run on Colab Jupyter Notebook.