ALGORITHM FOR IDENTIFYING NUMERICAL INDICATORS OF NETWORK TRAFFIC ANOMALIES BASED ON A RANDOM FOREST MODEL

Abstract

This paper presents an algorithm that extracts numerical threshold values from a random forest model for detecting anomalies caused by various types of network attacks. It allows an identification of both individual threshold values and ranges of normal or anomalous values, as well as the assessment of their statistical significance. The proposed algorithm is evaluated using the CIC-IDS2017 dataset to identify specific changes in statistical characteristics during particular types of attacks. Traffic is analyzed as a sequence of packet inter-arrival times, a sequence of packet sizes, and time series representing packet counts or total byte volumes per unit of time. The traffic is split into nonoverlapping one-minute intervals, feature correlations are assessed, and separate classification models are trained for each attack category. For models with the highest F1-score, the proposed algorithm is applied to identify the most significant attack features related to changes in statistical characteristics. Results indicate that, across multiple attack groups, significant thresholds are identified for features corresponding to the autocorrelation function values at different lags, suggesting that changes in correlation can be used to detect these attacks.