Machine Learning Anomaly Detection System
Machine Learning for Anomaly Detection in Network Traffic
A Final Year Project by Luke Morris
I will be attempting to create a solution including machine learning to detect anomalies in a given dataset of network traffic. This will involve picking apart a PCAP provided by the user or using (wire|t)shark / tcpdump to read packets directly from the network to provide the machine learning algorithm with data. The ML algorithm will then be able to 'learn' normal traffic sequences. This enables the algorithm to determine when an anomaly is detected and thus alert the owner of the network.
This project will be in the form of:
- A final report including a literature review
- This software
- A portfolio including meeting minutes, CV and a self review
The software provided in this project contains a database, a machine learning algorithm trained to detect anomalies in a PCAP file, and a system to alert users.
Installing the software
This software is available on PyPI as mlads_lukem_fyp and can be installed using pip:
pip install mlads_lukem_fyp
Running the software
To run the software and begin detecting anomalies, run the MLADS.py file from the mlads_lukem_fyp directory.
>>> from mlads_lukem_fyp.MLADS import start_mlads
The page used to view previous alerts or detections by the software. Alerts can be searched through using the fields at the top of the page.
When an alert is highlighted, further details on the alert can be viewed.
PCAP files can be 'uploaded' to the software. The file is fed through a feature extractor into a CSV that is then used by the machine learning algorithm.
Alerts are generated and sent via SMS and email. These alerts can also be viewed in the 'View Alerts' page.
This page runs very slowly when loading a large file, please be patient.
The contacts to be alerted when the software detects anomalies are kept up to date here, and contacts stored in a database.
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Hashes for mlads_lukem_fyp-1.0.5-py2.py3-none-any.whl