论文库

原文摘要

Firewall log classification is important to monitor network traffic. Machine learning classifiers using network-related features have shown good results for this task, but high-dimensional features slow down classification. In this paper, we apply feature selection using bee swarm optimization with Q-learning-based local search (QBSO-FS) to the UCI Internet Firewall Data Set, together with random forest (RF), k-nearest neighbor (KNN), and Bernoulli naïve Bayes (Bernoulli NB) classifiers. The first version of this preprint selected and evaluated feature subsets on the same 5-fold cross-validation of the full data set, which contains 12.8\% exact duplicates; the reported scores are therefore optimistically biased. In this extended version, we re-evaluate the method with a leakage-free protocol: the data are split into training, validation, and test sets, features are selected using the validation set only, and accuracy and macro-averaged scores are measured once on the untouched test set, for both the raw data and a deduplicated, preprocessed version. On a single stratified split, QBSO-FS selects 5--7 features. The selected subsets clearly improve Macro-F1 over all features for KNN on both data sets and for RF on the deduplicated data (by 8--19 percentage points). For RF on the raw data and for Bernoulli NB, the differences (0.2--1.5 percentage points) may not hold for a different split. RF with 7 selected features reaches 99.90\% accuracy and 94.88\% Macro-F1 on the deduplicated data. On the same split, this exceeds our re-implementations of the deep neural network configurations of previous studies and the feature subset selected by particle swarm optimization in one of them, while the run time saved on this low-dimensional data set is small. These results suggest that the method can support automatic firewall log analysis, while evaluation over multiple splits remains future work.