presentaion.md

marp	true
theme	uncover
paginate	true
size	58140
style	section { text-align: left; }

Network Intrusion Detection

by Charaf-Eddine M'rah

---

1- Introduction

---

Objective of the Project

The main objective of this project is to build a machine learning model that can detect network intrusions and other malicious activity with high accuracy.

---

• The KDD Cup 99 dataset is a widely used benchmark dataset in data mining and machine learning, containing 41 features and 494,021 instances. The dataset we're using is a subset of the original dataset.

• The purpose of the KDD Cup 99 dataset is to evaluate the performance of algorithms for detecting network intrusions and other malicious activity.

---

Machine Learning Models

The following machine learning models were applied:

• Logistic Regression
• K-Nearest Neighbors
• Random Forest
• Support Vector Machine

---

2 - Data Exploration and Preprocessing

---

• The raw data is in the form of a CSV file with 25192 rows and 42 columns.

---

• The dataset is balanced with 13449 normal connections and 11743 malicious connections.

---

---

---

---

• dst_host_srv_serror_rate: % of connections that have "SYN" errors
• same_srv_rate: % of connections to the same service

---

• Used Random Forest to determine the most important features.
• 11 features are selected based on their importance.

---

Data splitting

• The dataset was split into a training set (80%) and a test set (20%).

• The test dataset is used to evaluate the final model.

---

3 - Models Training

---

The four machine learning models that were applied are:

• Logistic Regression
• K-Nearest Neighbors
• Random Forest
• Support Vector Machine

---

Logistic Regression

Logistic regression is a statistical model that in its basic form uses a logistic function to model a binary dependent variable.

---

K-Nearest Neighbors

K Nearest Neighbors is a non-parametric method used for classification and regression.

---

Random Forest

Random forest is a supervised learning algorithm. It can be used both for classification and regression problems.

---

Support Vector Machine

Support Vector Machine is a supervised machine learning algorithm which can be used for both classification or regression challenges.

---

4 - Model Evaluation

---

---

---

---

---

• The confusion matrix for the Random Forest model and Logistic Regression model are equal.

• But does that mean they'll perform the same?

---

Cross-Validation

• Used 10-fold cross-validation to evaluate the models.

---

Key Insights

• The Random Forest model has the best performance with an accuracy of 99.5% and a false negative rate of 0.004%.

• Logistic Regression might be overfitting the data.

• The Logistic Regression model has the worst performance with an accuracy of 93.7%.

---

---

5 - Summary

• Machine learning models can be used to detect network intrusions and other malicious activity with high accuracy.
• The Random Forest model has the best performance with an accuracy of 99.5%.
• This is an alternative to the traditional signature-based detection methods.

---

Thank You

Full code is available on GitHub

https://github.com/charafmrah/network-intrusion-detection