Intrusion-detection

KDD process to mine patterns for intrusion detection

Index

1. What is
2. System Dependencies
3. Quick Start
4. Dataset
5. Evaluation and Results
6. Credits

What is

It is an application developed for "Data analysis for security" exam at University Aldo Moro of Bari Italy.
its goal is to able to classify android application network traffic into genuine or malware.

• Requirements and Dependencies

  Python 3 or higher (tested on 3.7)
  pandas~=1.1.3
  scikit-learn~=0.22.2
  
  

• Quick Start

  1 - Clone this repository
  2 - Install all dependencies
  4 - Execute "kdd_process.py"
  5 - Enjoy

• Dataset

  Subset of data collected by the Canadian Institute of Cybersecurity Android Adware and General Malware Dataset in 2017.
  10,000 examples for training: 8000 normal examples and 2000 attacks.
  80 attributes: 79 numeric and 1 binary (1 = Normal, 0 = Attack).
  2000 examples for testing: 1600 normal, 2000 attack.

• Evaluation and Results

  5 fold cross validation to find the best configuration (n_estimators, bootstrap, randomization) for a random forest.
  One random forest constructed from the original dataset.
  Another one built from the top 10 main components (PCA).
  Parameters: randomization sqrt and log2, n_estimators between 10, 20 and 30, bootstrap between 0.5, 0.6, 0.7, 0.8 and 0.9
  Best configuration evaluated taking into account the best average fscore value on the test folds.
  Learning of a random forest on the entire original dataset with: n_estimators = 10, bootstrap = 0.9, randomization = sqrt.
  Learning of a random forest on the dataset by applying the PCA with: n_estimators = 20, bootstrap = 0.9, randomization = log2.
  Learning of a staker of the two previous points using the KNN with K = 3.
  
  

• Credits

  Developed and Designed by:

  mpia3