mlads-lukem-fyp 1.0.3

Machine Learning Anomaly Detection System

Machine Learning for Anomaly Detection in Network Traffic

A Final Year Project by Luke Morris

An overview

I will be attempting to create a solution including machine learning to detect anomalies in a given dataset of network traffic. This will involve picking apart a PCAP provided by the user or using (wire|t)shark / tcpdump to read packets directly from the network to provide the machine learning algorithm with data. The ML algorithm will then be able to 'learn' normal traffic sequences. This enables the algorithm to determine when an anomaly is detected and thus alert the owner of the network.

This project will be in the form of:

• Literature review
• Meeting minutes
• A working piece of software
• Portfolio

The software provided in this project contains a database, a machine learning algorithm trained to detect anomalies in a PCAP file, and a system to alert users.

Running the software

To run the software and begin detecting anomalies, run the MLADS.py file from the scripts directory.

View Alerts

The page used to view previous alerts or detections by the software. Alerts can be searched through using the fields at the top of the page.

When an alert is highlighted, further details on the alert can be viewed.

Analyse PCAPs

PCAP files can be 'uploaded' to the software. The file is fed through a feature extractor into a CSV that is then used by the machine learning algorithm.

Alerts are generated and sent via SMS and email. These alerts can also be viewed in the 'View Alerts' page.

This page runs very slowly when loading a large file, such as the provided Xample csvs...

Edit Contacts

The contacts to be alerted when the software detects anomalies are kept up to date here, and contacts stored in a database.

Live Capture

Coming soon...