Netcap Tensorflow Deep Neural Network
This repository contains a python implementation for using a Deep Neural Network with Keras and Tensorflow, that operates on CSV data produced by the netcap framework.
It is based on the implementation demonstrated by Prof Jeff Heaton's Washington University (in St. Louis) Course T81-558: Applications of Deep Neural Networks, that has been adapted and parameterized in order to offer flexibility for experiments.
This project was created for my bachelor thesis "Implementation and evaluation of secure and scalable anomaly-based network intrusion detection", to conduct a series of experiments on identifying malicious behavior in the CIC-IDS-2017 dataset. The thesis and presentation slides are available on researchgate. Each experiment is executed with a dedicated shell script.
Watch a quick demo of the deep neural network for classification of malicious behavior, on a small PCAP dump file with traffic from the LOKI Bot. First, the PCAP file is parsed with netcap, in order to get audit records that will be labeled afterwards with the netlabel tool. The labeled CSV data for the TCP audit record type is then used for training (75%) and evaluation (25%) of the classification accuracy provided by the deep neural network.
Usage
$ netcap-tf-dnn.py -h
usage: netcap-tf-dnn.py [-h] -read READ [-drop DROP] [-sample [SAMPLE]]
[-dropna] [-string_dummy] [-string_index]
[-test_size TEST_SIZE] [-loss LOSS]
[-optimizer OPTIMIZER]
NETCAP compatible implementation of Network Anomaly Detection with a Deep
Neural Network and TensorFlow
optional arguments:
-h, --help show this help message and exit
-read READ Labeled input CSV file to read from (required)
-drop DROP optionally drop specified columns, supply multiple
with comma
-sample [SAMPLE] optionally sample only a fraction of records
-dropna drop rows with missing values
-string_dummy encode strings as dummy variables
-string_index encode strings as indices (default)
-test_size TEST_SIZE specify size of the test data in percent (default:
0.25)
-loss LOSS set function (default: categorical_crossentropy)
-optimizer OPTIMIZER set optimizer (default: adam)
License
Apache License 2.0