Network Traffic Classification Based on SD Sampling and Hierarchical Ensemble Learning

With the increase in cyber threats recent years, there have been more forms of demand for network security protection measures. Network traffic classification technology is used to adapt dynamic threat environment. However, has a natural unbalanced class distribution problem, and single model leads low accuracy high false-positive rate traditional detection model. Given above two problems, this paper proposes new dataset balancing method named SD sampling based on SMOTE algorithm. Different from algorithm, divides sample into types that are easy difficult classify only balances difficult-to-classify sample, which not overcomes SMOTE’s overgeneralization but also combines idea oversampling undersampling. In addition, two-layer structure combined with XGBoost random forest proposed multiclassification anomalous traffic, since using hierarchical can better minority abnormal traffic. This conducts experiments CICIDS2017 dataset. The results show than 99.70% less 0.34%, indicating models.