Project Brief
- Role ML/Security Researcher
- Dataset CIC-IDS2017 & Custom PCAPs
- Objective Reduce false positives in standard IDS environments using predictive modeling.
The Context
Traditional Intrusion Detection Systems (IDS) rely heavily on signature-based detection, which often fails against zero-day exploits and generates overwhelming amounts of false positives. This project aimed to supplement existing IDS infrastructure with a behavioral-based ML approach.
Methodology
Using Python and TensorFlow, I built an anomaly detection pipeline:
- Feature Extraction: Extracted flow-based network traffic features (packet size, inter-arrival times, protocol types) from raw PCAP files.
- Model Training: Trained an Autoencoder neural network on benign traffic. The model learned the standard baseline of network behavior.
- Anomaly Scoring: Live traffic was fed into the model. Connections that yielded a high reconstruction error were flagged as anomalous, indicating potential DDoS, port scanning, or exfiltration attempts.
Results
The model successfully identified lateral movement techniques and slow-rate DDoS attacks that evaded traditional Snort rules. It achieved an accuracy rate of 94% on the test dataset while cutting down false positive alerts by roughly 35% compared to the baseline IDS.