Scholarlink

Network traffic is essential for modern communication, ensuring the proper functioning of daily activities. In today’s connected world, cybercriminals attempt to harm and extort users. To address this issue, various models have been proposed, yet they still underperform. This study proposes a new feature based on an aggregation method using the generalized Choquet integral, incorporating a parameter \(\alpha \) . To validate its effectiveness, we perform anomaly detection with Random Forest and XGBoost models, assessing its impact on detecting Hulk DoS attacks. Experimental results showed that our proposal significantly improved accuracy. The Random Forest model increased from 93.53% to 97.82% (4.59% improvement), while XGBoost rose from 93.52% to 97.69% (4.46% increase). More importantly, recall for the minority class (attacks) improved substantially, from 0.68 to 0.93 (37% increase) with Random Forest and from 0.68 to 0.92 (35% increase) for XGBoost, reducing false negatives and enhancing intrusion detection. These findings highlight the potential of Choquet-based feature engineering in improving anomaly detection.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Improving Anomaly Detection in Network Traffic Using Choquet-Based Feature Engineering for Random Forest and XGBoost Models

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Abreu Quevedo,
  • Denner Ayres,
  • Gabriel Teixeira,
  • Graçaliz Dimuro,
  • Giancarlo Lucca,
  • Bruno L. Dalmazo

摘要

Network traffic is essential for modern communication, ensuring the proper functioning of daily activities. In today’s connected world, cybercriminals attempt to harm and extort users. To address this issue, various models have been proposed, yet they still underperform. This study proposes a new feature based on an aggregation method using the generalized Choquet integral, incorporating a parameter \(\alpha \) . To validate its effectiveness, we perform anomaly detection with Random Forest and XGBoost models, assessing its impact on detecting Hulk DoS attacks. Experimental results showed that our proposal significantly improved accuracy. The Random Forest model increased from 93.53% to 97.82% (4.59% improvement), while XGBoost rose from 93.52% to 97.69% (4.46% increase). More importantly, recall for the minority class (attacks) improved substantially, from 0.68 to 0.93 (37% increase) with Random Forest and from 0.68 to 0.92 (35% increase) for XGBoost, reducing false negatives and enhancing intrusion detection. These findings highlight the potential of Choquet-based feature engineering in improving anomaly detection.