Machine learning model for anomaly-based network intrusion detection. Classifies network traffic patterns to identify potential attacks without relying on signature databases.
Signature-based firewalls miss zero-day attacks by definition — they only catch known threats. Anomaly-based detection using ML can identify suspicious patterns even from novel attack vectors.
- Feature engineering — extracts meaningful features from raw network traffic data (packet size, timing, protocol flags)
- Model training pipeline — comparison of classification algorithms for accuracy vs inference speed tradeoff
- Evaluation framework — precision, recall, F1 with focus on minimizing false negatives (missed attacks) over false positives
Why anomaly-based over signature-based: Signature databases require constant updates and miss novel attacks. An anomaly model trained on normal traffic profiles can flag deviations regardless of whether the attack type is known.
- Python · scikit-learn · pandas · NumPy · Jupyter