Spaces:
Sleeping
Sleeping
Update README.md
Browse files
README.md
CHANGED
|
@@ -1,19 +1,106 @@
|
|
| 1 |
---
|
| 2 |
-
title:
|
| 3 |
-
emoji:
|
| 4 |
-
colorFrom:
|
| 5 |
-
colorTo:
|
| 6 |
-
sdk:
|
| 7 |
app_port: 8501
|
| 8 |
-
tags:
|
| 9 |
-
- streamlit
|
| 10 |
pinned: false
|
| 11 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 12 |
---
|
| 13 |
|
| 14 |
-
#
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 15 |
|
| 16 |
-
|
|
|
|
| 17 |
|
| 18 |
-
|
| 19 |
-
|
|
|
|
| 1 |
---
|
| 2 |
+
title: NSL-KDD Anomaly Detection
|
| 3 |
+
emoji: π§
|
| 4 |
+
colorFrom: blue
|
| 5 |
+
colorTo: green
|
| 6 |
+
sdk: streamlit
|
| 7 |
app_port: 8501
|
|
|
|
|
|
|
| 8 |
pinned: false
|
| 9 |
+
tags:
|
| 10 |
+
- anomaly-detection
|
| 11 |
+
- streamlit
|
| 12 |
+
- machine-learning
|
| 13 |
+
- cybersecurity
|
| 14 |
+
---
|
| 15 |
+
|
| 16 |
+
# π§ NSL-KDD Anomaly Detection using Isolation Forest, One-Class SVM, and Logistic Regression
|
| 17 |
+
|
| 18 |
+
This Streamlit web app performs **network intrusion / anomaly detection** using the **NSL-KDD** dataset β a popular benchmark for cybersecurity and anomaly detection research.
|
| 19 |
+
It compares three models:
|
| 20 |
+
- π **Isolation Forest** (unsupervised)
|
| 21 |
+
- πΉ **One-Class SVM** (unsupervised)
|
| 22 |
+
- βοΈ **Logistic Regression** (supervised baseline)
|
| 23 |
+
|
| 24 |
+
---
|
| 25 |
+
|
| 26 |
+
## π Live Demo
|
| 27 |
+
π Try it on **Hugging Face Spaces**:
|
| 28 |
+
*(Replace with your actual Space link after deployment)*
|
| 29 |
+
|
| 30 |
+
---
|
| 31 |
+
|
| 32 |
+
## π§ Overview
|
| 33 |
+
|
| 34 |
+
The **NSL-KDD dataset** is an improved version of the classic **KDD Cup β99** dataset for intrusion detection.
|
| 35 |
+
It contains labeled examples of **normal** and **attack** network connections, described by 41 features such as protocol type, service, flag, duration, and bytes transmitted.
|
| 36 |
+
|
| 37 |
+
This project:
|
| 38 |
+
- Loads the NSL-KDD dataset (from local file or online source)
|
| 39 |
+
- Performs preprocessing and scaling
|
| 40 |
+
- Trains and compares:
|
| 41 |
+
- Isolation Forest
|
| 42 |
+
- One-Class SVM
|
| 43 |
+
- Logistic Regression
|
| 44 |
+
- Computes accuracy, precision, recall, F1-score, and confusion matrices
|
| 45 |
+
- Visualizes anomalies using Seaborn and Matplotlib
|
| 46 |
+
|
| 47 |
+
---
|
| 48 |
+
|
| 49 |
+
## βοΈ How It Works
|
| 50 |
+
|
| 51 |
+
1. Load and clean NSL-KDD dataset
|
| 52 |
+
2. Convert categorical variables (e.g., protocol, service, flag) to numeric form
|
| 53 |
+
3. Scale the features using **StandardScaler**
|
| 54 |
+
4. Train and evaluate the following models:
|
| 55 |
+
- **Isolation Forest** β Detects outliers by random partitioning
|
| 56 |
+
- **One-Class SVM** β Learns boundary around normal samples
|
| 57 |
+
- **Logistic Regression** β Supervised baseline using true labels
|
| 58 |
+
5. Display results and metrics interactively in Streamlit
|
| 59 |
+
|
| 60 |
+
---
|
| 61 |
+
|
| 62 |
+
## π§Ύ Dataset: NSL-KDD
|
| 63 |
+
|
| 64 |
+
| Column Type | Description |
|
| 65 |
+
|--------------|-------------|
|
| 66 |
+
| Numerical | Continuous numeric features (e.g., duration, src_bytes, dst_bytes) |
|
| 67 |
+
| Categorical | protocol_type, service, flag |
|
| 68 |
+
| Target | normal / attack |
|
| 69 |
+
|
| 70 |
+
π You can download it from:
|
| 71 |
+
https://www.unb.ca/cic/datasets/nsl.html
|
| 72 |
+
or use a preprocessed CSV copy.
|
| 73 |
+
|
| 74 |
+
---
|
| 75 |
+
|
| 76 |
+
## π Example Outputs
|
| 77 |
+
|
| 78 |
+
- Model Accuracy Comparison
|
| 79 |
+
- Confusion Matrices for each model
|
| 80 |
+
- Bar chart of precision, recall, and F1-score
|
| 81 |
+
- Sample prediction visualization
|
| 82 |
+
|
| 83 |
+
---
|
| 84 |
+
|
| 85 |
+
## π§° Technologies Used
|
| 86 |
+
|
| 87 |
+
- **Python 3.9+**
|
| 88 |
+
- **Streamlit** β web UI
|
| 89 |
+
- **Scikit-learn** β model training
|
| 90 |
+
- **Pandas / NumPy** β data handling
|
| 91 |
+
- **Matplotlib / Seaborn** β visualization
|
| 92 |
+
|
| 93 |
---
|
| 94 |
|
| 95 |
+
## ποΈ Local Setup (Optional)
|
| 96 |
+
|
| 97 |
+
```bash
|
| 98 |
+
# Clone the repository
|
| 99 |
+
git clone https://huggingface.co/spaces/your-username/nsl-kdd-anomaly-detection
|
| 100 |
+
cd nsl-kdd-anomaly-detection
|
| 101 |
|
| 102 |
+
# Install dependencies
|
| 103 |
+
pip install -r requirements.txt
|
| 104 |
|
| 105 |
+
# Run Streamlit app
|
| 106 |
+
streamlit run app.py
|