🤖 Project 07 — ML-Based Intrusion Detection System

Type: Data/ML project (Python) Modules: 10 (Intrusion Detection & ML for Security) Difficulty: ⭐⭐⭐⭐

---

🎯 Objective

Build a binary intrusion-detection classifier — normal vs. attack traffic — using a public network-traffic dataset and a Support Vector Machine, then evaluate it with the metrics that actually matter for a security use case.

---

🛠️ Setup / Requirements

• Python 3 with pandas, numpy, scikit-learn, and matplotlib/seaborn.
• A labeled connection-log dataset — the NSL-KDD dataset (a public, well-known intrusion-detection benchmark) is recommended; see 10-04: Feature Engineering (NSL-KDD) for background on its structure.

---

🧩 Tasks

🔹 Part A — Load and Clean

1. Load the dataset into a pandas DataFrame.
2. Drop irrelevant or constant-value columns that don't help distinguish normal from attack traffic.
3. Encode the categorical fields (protocol_type, service, flag, …) — see 10-04: Feature Engineering (NSL-KDD) for why one-hot encoding is preferred over plain label encoding for these fields.
4. Encode the label as binary: 0 for normal, 1 for any attack category.

🔹 Part B — Split and Scale

1. Split the data into training and test sets (a 70/30 split with a fixed random_state is a reasonable default, for reproducibility).
2. Scale the numeric features with StandardScaler, fitting only on the training data and applying the same transform to the test data.

🔹 Part C — Train and Predict

1. Train a Support Vector Machine classifier (sklearn.svm.SVC) on the scaled training data — see 10-05: SVMs for Classification for the underlying idea of the maximum-margin hyperplane.
2. Predict on the held-out test set.

🔹 Part D — Evaluate and Analyze

1. Compute the confusion matrix and the accuracy, precision, recall, and F1-score (see 10-07: Evaluating Detection Models for the formulas and how to interpret each one operationally).
2. Write a short analysis: which metric matters most for this specific use case, and why? What would a false negative vs. a false positive actually mean for a security team relying on this model?

Starter Skeleton

import pandas as pd
from sklearn.preprocessing import LabelEncoder, StandardScaler
from sklearn.model_selection import train_test_split
from sklearn.svm import SVC
from sklearn.metrics import confusion_matrix, classification_report, f1_score, accuracy_score

# 1. Load
dataset = pd.read_csv("network_traffic.csv")

# 2. Clean — drop irrelevant/constant columns
# dataset = dataset.drop(columns=[...])

# 3. Split features/target, encode label
X = dataset.drop("label", axis=1)
y = LabelEncoder().fit_transform(dataset["label"])   # normal=0, attack=1

# 4. One-hot encode categorical features, keep numeric ones
X = pd.concat(
    [pd.get_dummies(X.select_dtypes(include="object")),
     X.select_dtypes(exclude="object")],
    axis=1,
)

# 5. Train/test split
X_train, X_test, y_train, y_test = train_test_split(
    X, y, test_size=0.3, random_state=2
)

# 6. Scale
scaler = StandardScaler()
X_train_scaled = scaler.fit_transform(X_train)
X_test_scaled = scaler.transform(X_test)

# 7. Train and predict
svc = SVC(random_state=42)
svc.fit(X_train_scaled, y_train)
y_pred = svc.predict(X_test_scaled)

# 8. Evaluate
print(confusion_matrix(y_test, y_pred))
print(classification_report(y_test, y_pred))

---

✅ Verification Checklist

• Dataset loaded, cleaned, and categorical features correctly one-hot encoded.
• Label encoded as a binary target (normal/attack).
• Train/test split performed with scaling fit only on the training data.
• SVM trained and evaluated with a confusion matrix and all four metrics.
• Written analysis of which metric matters most and why, referencing the false-negative/false-positive tradeoff.

---

📦 Deliverables

• The final script (or notebook).
• The confusion matrix and computed metrics output.
• A short written analysis (half a page) of the results and their operational meaning.

---

🚀 Stretch Goals

• Train a Random Forest or Logistic Regression model on the same data and compare metrics side by side with the SVM.
• Do a feature-importance analysis (e.g., via a Random Forest's built-in feature importances) to see which traffic features are most predictive.
• Extend to multi-class classification — predict the specific attack category instead of just binary normal/attack — and discuss how the evaluation approach needs to change (e.g., per-class precision/recall).

See also notes: [[10-03-intro-to-ml-for-security]], [[10-04-feature-engineering-nsl-kdd]], [[10-05-svm-for-classification]], [[10-07-evaluating-detection-models]]