[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-290839-105":59,"doc-detail-290839-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","a-machine-learning-approach-to-network-security-anomaly-detection","A Machine Learning Approach To Network Security Anomaly Detection","","Supervised machine learning is used for classification in anomaly-based cyber-threat detection, emphasizing predictable results and high accuracy. The study applies the CICIDS2017 benchmark dataset and builds a two-layer detection model with binary benign/malicious traffic classification followed by multi-class attack type identification. Incremental PCA and SMOTE rebalance data for both tasks. LightGBM delivers the best results (99% accuracy, 98.1% F1-score) with minimal resource usage, outperforming SVM, KNN, Random Forest, and Decision Trees.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/a-machine-learning-approach-to-network-security-anomaly-detection/290839/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/a-machine-learning-approach-to-network-security-anomaly-detection/290839.png","ImageObject",300,407,{"name":92,"@type":93},"Skyler","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-02","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",16,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What detection model structure does the report propose?","Question",{"text":113,"@type":114},"It proposes a two-layer approach: a first layer performs binary classification of benign versus malicious traffic, and a second layer performs multi-class classification to identify specific attack types for targeted countermeasures.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Which dataset and imbalance-handling techniques are used?",{"text":118,"@type":114},"The report uses the CICIDS2017 dataset and applies Incremental PCA for dimensionality/feature handling and SMOTE to balance the dataset for both binary and multi-class tasks.",{"name":120,"@type":111,"acceptedAnswer":121},"Why is LightGBM highlighted as the top-performing model?",{"text":122,"@type":114},"LightGBM achieves superior performance with about 99% accuracy and 98.1% F1-score while using minimal resources, outperforming models such as SVM, KNN, Random Forest, and Decision Trees.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},290839,1789642748,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":130,"read_time":145,"preview_page_count":4},2336464648746,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","A Machine Learning Approach To  \nNetwork Security Anomaly Detection  \nby  \nPRATEEK VERMA  \nA Project Report Submitted in Partial Fulfillment of the Requirements for the Degree of  \nMASTER OF ENGINEERING  \nIn the Department of Electrical and Computer Engineering  \n© PRATEEK VERMA, 2025  \nUniversity of Victoria  \nAll Rights Reserved. This project report may not be reproduced in whole or in part, by photocopying or other means, without the permission of the author.  \nWe acknowledge and respect the Lək̓ ʷəŋən (Songhees and Xʷsepsəm/Esquimalt) Peoples on whose territory the university stands, and the Lək̓ ʷ əŋən and ̱WSÁNEĆ Peoples whose historical relationships with the land continue to this day.  \nA Machine Learning Approach To Network Security Anomaly Detection  \nby  \nPRATEEK VERMA  \nSUPERVISORY COMMITTEE  \n\n| Prof. Hong-Chuan Yang, Supervisor\u003Cbr>(Department of Electrical and Computer Engineering) |\n| --- |\n| Prof. Fayez Gebali , Departmental Member\u003Cbr>(Department of Electrical and Computer Engineering) |\n\nABSTRACT  \nSupervised machine learning has emerged as a highly effective technique for classification in anomaly-based cyber-threat detection systems due to its predictability, and high accuracy. This work utilizes the CICIDS2017 dataset which is widely recognized as a benchmark for anomaly detection research. The work begins with the idea to implement a two-layered MLbased detection model. The proposed system’s first layer performs binary classification to differentiate benign from malicious traffic, while a secondary, multi-class classification system identifies specific attack types to implement targeted countermeasures. Incremental Principal Component Analysis (PCA) technique and Synthetic Minority Oversampling (SMOTE) is applied to balance the dataset, critical for both binary and multi-class classification tasks. Among all evaluated machine learning models, LightGBM achieved superior performance with 99% accuracy, 98. 1% F1-score, and minimal resource usage, outperforming traditional methods like SVM, KNN, Random Forest and Decision Trees. Further feature reduction, guided by feature importance scores, led to an even more lightweight model while performance metrics such accuracy, recall, and F1-score, remained consistent or improved slightly within a margin of ±0 . 5% highlighting the stability and efficiency of the proposed approach. This proposed system demonstrates that advanced, resource-efficient supervised ML models such as LightGBM can significantly improve real-time threat detection while offering a scalable and cost-effective solution for future cybersecurity deployments.  \nTable of Contents  \nSupervisory Committee ....................................................... ii  \nAbstract .................................................................... iii  \nTable of Contents ............................................................ iv  \n[List of Tables](List of Tables ................................................................ vi)[ ................................................................ vi](List of Tables ................................................................ vi)  \n[List of Figures](List of Figures ............................................................... vii)[ ............................................................... vii](List of Figures ............................................................... vii)  \n[Acknowledgements](Acknowledgements .......................................................... ix)[ .......................................................... ix](Acknowledgements .......................................................... ix)  \n[List of Acronyms](List of Acronyms ............................................................. x)[ ............................................................. x](List of Acronyms ............................................................. x)  \n[1 Chapter 1: Introduction](1 Chapter 1: Introduction)  \n1.1 Motivation ........","cbCaicI106miJLfS","https://ap.wps.com/l/cbCaicI106miJLfS","pdf",3465211,79,"English","# Supervisory Committee\n# Abstract\n# Table of Contents\n# List of Tables\n# List of Figures\n# Acknowledgements\n# List of Acronyms\n# 1 Chapter 1: Introduction\n## 1.1 Motivation\n## 1.2 Related Work\n## 1.3 Objectives\n## 1.4 Report Structure\n# 2 Chapter 2: Overview of Machine Learning\n## 2.1 Supervised Learning\n## 2.2 Binary Classification\n## 2.3 Multi-class Classification\n## 2.4 Overview of Machine Learning Tools\n# 3 Chapter 3: Methodology\n## 3.1 Dataset Exploration\n## 3.2 Types of Cyber-Attacks\n## 3.3 Data Cleaning and Imputation\n## 3.4 Data Preprocessing\n## 3.5 Machine Learning Overview\n## 3.6 LightGBM-An Optimized Approach for High-Performance Anomaly Detection\n# 4 Chapter 4: Performance Evaluation\n## 4.1 Evaluation Metrics\n## 4.2 Performance Evaluation for Binary Classification\n## 4.3 Tabular Comparison: Performance Evaluation for Binary Classification\n## 4.4 Performance Evaluation as a Function of Reduced Features for Binary Classification\n## 4.5 Performance Evaluation for Multi-Class Classification\n## 4.6 Tabular Comparison: Performance Evaluation for Multi-Class Classification\n## 4.7 Performance Evaluation as a Function of Reduced Features for Multi-Class Classification\n# 5 Chapter 5: Conclusions and Future Work","[{\"question\":\"What detection model structure does the report propose?\",\"answer\":\"It proposes a two-layer approach: a first layer performs binary classification of benign versus malicious traffic, and a second layer performs multi-class classification to identify specific attack types for targeted countermeasures.\"},{\"question\":\"Which dataset and imbalance-handling techniques are used?\",\"answer\":\"The report uses the CICIDS2017 dataset and applies Incremental PCA for dimensionality/feature handling and SMOTE to balance the dataset for both binary and multi-class tasks.\"},{\"question\":\"Why is LightGBM highlighted as the top-performing model?\",\"answer\":\"LightGBM achieves superior performance with about 99% accuracy and 98.1% F1-score while using minimal resources, outperforming models such as SVM, KNN, Random Forest, and Decision Trees.\"}]","A Machine Learning Approach To Network Security Anomaly Detection | PDF",199]