INTRUSION DETECTION SYSTEM
USING MACHINE LEARNING
INTRODUCTION
Intrusion : Attempting to break into or misuse
your system.
Intruders may be from outside the network or
legitimate users of the network.
Intrusion can be a physical, system or remote
intrusion.
Intrusion Detection Systems look for attack
signatures, which are specific patterns that
usually indicate malicious or suspicious intent.
WORK DONE!
Step
1
Network
Dataset(K Step
DD’99
dataset) 2
Pre- Step
Processin
g of Data 3
Feature Step
Extractio
n
4
Training
and Step
Testing of
Data 5
Result
Analysis
NETWORK DATASET (KDD’99 Dataset)
KDD Cup 1999 has 4,898,431 Data Norma Probin
DoS R2L U2R
records in “train data set” & 311027 Set l g
records in “test data set”
10%
97277 4107 391458 1126 52
KDD
KDD data set has 41 features
Correcte
60593 4106 229853 11347 70
Types of Attack d KDD
DoS – Denial of service
Whole 972780 41102 3883370 1126 50
R2L – Remote to local attack
U2R – User to Root attack
Probe – Probing attack
PRE-PROCESSING OF DATA
What is data cleaning?
Fill in missing values, smooth noisy
data, identify or remove outliers and
resolve inconsistencies.
What factors will be improved
after pre-processing of data?
Accuracy
Integrity
Completeness
Validity
Consistency…
FEATURE EXTRACTION/ ENGINEERING
Example
MACHINE LEARNING CLASSIFIERS
We have used five classifiers in our model , they are
DECISION TREE
NAÏVE BAYES
K-NEAREST NEIGHBOR (KNN)
RANDOM FOREST CLASSIFIER
LOGISTIC REGRESSION
If you guys want , can add slides to explain the classifiers
TRAINING AND TESTING OF DATA
How are we training the model using KDD dataset?
How are we testing the data ?
What is a confusion matrix?
What are the result parameters that measure our model’s performance?
RESULTS
RESULTS
CONCLUSIONS
INTRUSION DETECTION APPLICATION:
An Intrusion detection application is developed from the knn model, flak front
end, HTML, CSS and java script. So, when a new file which contains the
details of a network is given to the intrusion detection application, it will be
able to detect weather the network is malicious or normal.
THANK YOU
