.png){kind=icon}
.png){kind=icon}
Return
Cost-Aware Network Traffic Anomaly Detection with Histogram-Based Gradient Boosting
.png){kind=icon}
PRE
AI
Z
DOI：10.3390/app16073496.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Intrusion Detection Systems (IDSs) operate under asymmetric misclassification costs: false alarms (FP) consume analysts' time and erode trust, whereas missed attacks (FN) carry business risks. This paper presents a complete pipeline for network anomaly detection on the CIC-IDS2017 dataset using Histogram-Based Gradient Boosting (HGB), with a particular focus on cost-aware threshold selection on a validation split for representative operating regimes wFP:wFN is an element of{1:1, 1:2, 1:3, 1:4, 1:5, 1:10}-treated as scenario-based proxies for varying risk posture, attack severity, and analyst workload rather than as universally fixed costs-and on the role of isotonic calibration. The results indicate that (i) under 1:1, the cost-optimal operating point aligns with the F1/MCC optimum; (ii) for 1:k cost regimes, the optimum shifts to lower thresholds, reducing FN at the expense of FP and increasing the alert rate; and (iii) isotonic calibration improves PR/ROC (ranking separation), but in the reported 1:5 experiment it did not reduce the final TEST-set operational cost relative to the uncalibrated run, despite using a separately selected post-calibration threshold. The evaluation includes PR/ROC curves, Cost-Threshold and Alert-Threshold sweeps, per-class recall, and permutation importance. In addition, the proposed approach is compared with unsupervised baselines (Isolation Forest, LOF). The results provide practical guidance for SOC decisions on how to choose thresholds consistent with alert budgets and risk profiles. In deployment, these operating points can be indexed to context (e.g., user type, service class, or time of day), yielding a small library of adaptive thresholds rather than one immutable global threshold.
Keywords:
intrusion detection
anomaly detection
cost-sensitive classification
probability calibration
threshold selection
CIC-IDS2017
histogram-based gradient boosting
precision-recall
ROC
permutation importance
operational metrics
security operations center (SOC)
Journal
A
IF:
2.5
Papers:
5.9K
Citations:
4
Organization
Cited Papers