Analysis and creation of network traffic datasets to detect computer attacks

Abstract

The paper examines analysis and formation features of network traffic to detect network anomalies. The paper considers the NSL-KDD and UNSW-NB15 network attack datasets and identifies redundant features of network traffic in them. The selection of the most significant features is carried out to identify anomalies. A new set of modern network attacks is being formed to test machine learning algorithms. The analysis of machine learning methods (classifier of k-nearest neighbors, classifier of random forest, classifier of multilayer perceptron, XGBoost) is carried out for the problem of intrusion detection based on the studied and created datasets. The classification quality is evaluated using the following metrics: Accuracy and F1-score. The results obtained in this work can be applied to testing, machine learning methods and the development of intrusion detection systems.