Hybrid Attack CIC-IDS2017 Different Dataset Flask App in Python Projects

Hybrid Attack CIC-IDS2017 Different Dataset Flask App in Python Projects
Abstract
The Hybrid Attack Detection project builds an intelligent intrusion-detection application in Python that uses the CIC‑IDS2017 dataset (optionally combined with other network/security datasets) to detect a wide range of network attacks. The system ingests flow-level features extracted from PCAPs or CSV logs, performs robust preprocessing and feature engineering, and trains hybrid detection models that combine classical ML (e.g., Random Forest, XGBoost) with deep learners (e.g., small CNN/LSTM on time-windowed flows) or ensemble/stacking strategies to improve detection of both known and emerging attack types. Packaged as a Flask web app, the solution provides an easy-to-use interface for uploading network traces or live flow streams, running batch or real-time inference, visualizing alerts and metrics, and exporting flagged records for investigation. The project emphasizes practical issues — class imbalance handling, concept drift mitigation, explainability (feature importance / SHAP), and deployability — to deliver a production-friendly IDS prototype that is accurate, interpretable, and extensible.
Existing System
Most existing network intrusion detection solutions fall into two categories: signature/rule-based systems (IDS/IPS) that are fast but brittle against novel attacks, and single-model machine-learning solutions trained on a single dataset that often generalize poorly to different traffic distributions or mixed attack types. Many academic solutions trained on CIC‑IDS2017 or similar datasets demonstrate good lab accuracy but omit real-world concerns such as heavy class imbalance, heterogeneous data sources, evolving attack patterns, noisy features from flow extraction, and the operational need for a user-facing dashboard. Furthermore, single-model pipelines often miss multi-stage or low-and-slow attacks and lack explainability and retraining workflows, making them difficult for security operators to trust and integrate.

Proposed System
The proposed system implements a hybrid detection pipeline that (1) supports multiple input sources (CIC‑IDS2017 flows, optional additional datasets or live NetFlow/IPFIX), (2) applies rigorous preprocessing (missing-value handling, normalization, categorical encoding, time-window aggregation), (3) uses feature selection/dimensionality reduction (mutual information, PCA) and imbalance remedies (SMOTE, class-weighting), and (4) trains an ensemble of classifiers (tree-based models + neural sequence models) with stacking to capture both per-flow discriminative signals and temporal patterns across flows. Model evaluation uses precision/recall/F1, AUC, per-class metrics and confusion analysis to tune thresholds for operational trade-offs. The trained model is wrapped in a Flask application that exposes endpoints for single-record and batch inference, an admin UI for uploading datasets and kicking off retraining, and visualization pages showing detection counts, ROC/PR curves, feature importance, and flagged flow details. Additional operational features include a retraining queue for new labeled incidents, simple alerting (email/webhook), model versioning, and lightweight explainability (top contributing features or SHAP summaries) so analysts can triage alerts. Implementation uses standard Python stacks (Pandas, Scikit‑learn, Imbalanced‑learn, TensorFlow/Keras or PyTorch, Flask, OpenCV/plotly for visuals), and the design prioritizes modularity so new datasets, feature extractors, or model types can be added without reworking the app.

Customer Reviews (0)

Share Your Experience

Rating

Your Comment

Submit Review Cancel

No reviews yet. Be the first!