|
|
--- |
|
|
license: mit |
|
|
--- |
|
|
Model Name |
|
|
CyberAttackClassifier V1 – A Random Forest-based model for classifying cybersecurity attacks using network and system log data. |
|
|
|
|
|
📖 Overview |
|
|
CyberAttackClassifier V1 is a supervised machine learning model trained to classify various types of cybersecurity attacks based on structured log and alert data. It uses a Random Forest Classifier trained on a feature-selected dataset, achieving near-perfect performance across multiple evaluation metrics. |
|
|
|
|
|
🔍 Intended Uses |
|
|
Threat Detection: Automatically classify incoming events or logs into known attack categories. |
|
|
|
|
|
Security Monitoring: Enhance SIEM systems with predictive capabilities. |
|
|
|
|
|
Feature Analysis: Identify key indicators and patterns associated with different attack types. |
|
|
|
|
|
Incident Response Prioritization: Quickly assess and categorize threats for faster triage. |
|
|
|
|
|
🧠 Model Architecture |
|
|
Attribute Value |
|
|
Model Type Random Forest Classifier |
|
|
Framework scikit-learn |
|
|
Input Shape (raw) (100000, 197) |
|
|
Input Shape (selected) (100000, 50) |
|
|
Feature Selection SelectKBest (f_classif) |
|
|
Categorical Imputation 'Unknown' for missing values |
|
|
Encoding One-hot for categorical features |
|
|
Scaling StandardScaler for numerical features |
|
|
📚 Training Details |
|
|
Dataset Size: 100,000 samples |
|
|
|
|
|
Missing Values: Imputed in object-type columns |
|
|
|
|
|
Feature Selection: Top 50 features selected using ANOVA F-test |
|
|
|
|
|
Train/Test Split: Standard split (e.g., 80/20 or stratified) |
|
|
|
|
|
📈 Evaluation Metrics |
|
|
Metric Value |
|
|
Accuracy 0.9980 |
|
|
Precision ~0.9980 |
|
|
Recall ~0.9980 |
|
|
F1-score ~0.9980 |
|
|
✅ Note: These metrics indicate strong performance across all attack types, with minimal misclassifications. |
|
|
|
|
|
📊 Confusion Matrix & Classification Report |
|
|
Confusion Matrix: Dominant diagonal, indicating high true positive rates |
|
|
|
|
|
Classification Report: High precision, recall, and F1-scores for most attack classes |
|
|
|
|
|
🔍 Feature Importance |
|
|
Top features identified using Random Forest’s feature_importances_ attribute |
|
|
|
|
|
Further analysis of top 10–15 features recommended to understand key attack indicators |
|
|
|
|
|
Feature names available via mapping from SelectKBest output |
|
|
|
|
|
🚀 How to Use |
|
|
python |
|
|
from cyberattackclassifier import AttackModel |
|
|
|
|
|
model = AttackModel.load_pretrained("your-huggingface-username/cyberattackclassifier-v1") |
|
|
input_data = { |
|
|
"Firewall Logs": "Unknown", |
|
|
"Proxy Information": "Blocked", |
|
|
"IDS/IPS Alerts": "High", |
|
|
... |
|
|
} |
|
|
prediction = model.predict(input_data) |
|
|
⚠️ Limitations |
|
|
Imbalanced Data Risk: Ensure attack types are well-represented in training data |
|
|
|
|
|
Feature Drift: Model may degrade if log formats or attack patterns evolve |
|
|
|
|
|
Interpretability: Random Forests are less interpretable than linear models; use feature importance tools |
|
|
|
|
|
📄 License |
|
|
Apache 2.0 or MIT License (choose based on your preference) |
|
|
|
|
|
👤 Author |
|
|
Created by [Your Name or Organization] |
|
|
|
|
|
📚 Recommendations for Open-Sourcing |
|
|
Include preprocessing pipeline (imputation, encoding, scaling) |
|
|
|
|
|
Provide training and evaluation scripts |
|
|
|
|
|
Share feature importance analysis and mapping |
|
|
|
|
|
Document attack type taxonomy used in classification |
