Network Intrusion Detection System
Network Intrusion Detection System
Network Intrusion Detection System
CHAPTER 1
INTRODUCTION
With the advancement in the technology, millions of people are now connected with each
other through one or other form of network where they share lots of important data.
Hence the need of security to safeguard data integrity and confidentiality is increased
rapidly. Although effort have been made to secure data transmission but at the same time,
attack technique for breaching the network continued to evolve. Intrusion detection
system (IDS) is software and/or hardware designed to detect unwanted attempts at
accessing, manipulating, and/or disabling of computer systems, mainly through a
network, such as the Internet. Firewalls limits access between networks to prevent
intrusion and do not signal an attack from inside the network.
An IDS evalu- ates a suspected intrusion once it has taken place and signals an
alarm. As the network of computers expands both in number of hosts connected and
number of services provided, security has become a key issue for the technology
developers. This work presents a pro- totype of an intrusion detection system for
networks. There is often the need to update an installed Intrusion Detection System (IDS)
due to new attack methods or upgraded computing environments. Since many current
IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are
expensive and slow.
The dataset used for training the model is KDD 99 dataset. The reason why we
have used machine learning is the flexibility that it provides to the system for example, if
any new type of attack is developed in future the system can be trained for predicting that
attack. There are a few types of intrusion detection system out of which ours is a
knowledge based intrusion detection system which is also known as the anomaly based
system. It registers the anomalies and in future predicts such malicious network to send
out an alert. This way the network can disconnect to the such a connection and then have
only secured connections.
1.1 Purpose
The purpose of the system being built is to provide a solution for the Users to
protect their systems. Hence they can make a better understanding of the attacks and get
alerts on attacks.
1.2 Motivation
The motivation of this work is to tackle the issues of helping online shopping sites
and their users to protect their systems by monitoring and understanding about attacks.
We are proposing the Real Time Intrusion Detection System using ML algorithm
which mainly implies the detection of abnormal packets using past experience of the
system. Here the incoming packets are analysed and categorized according to values of
the attributes to produce dataset.
Using this data set the next arriving packets are detected as normal or abnormal
packets. If abnormal packets are detected reporting can be done.
.
Report Architecture
Chapter 2: Literature Survey gives details about the survey conducted before starting the
project.
Chapter 3: Methodology gives details about the approach in which the problem is being
solved
Chapter 4: System Analysis gives details about the existing system and proposed system.
Chapter 6: System Design describes the architecture, modules and data flow diagrams.
Chapter 8: System Testing discusses the test cases involved in testing the system.
Chapter 9: Results
Reference includes details of all books, papers and websites referred during project
development.
CHAPTER 2
LITERATURE SURVEY
In [1], Rafath and D Vasumathi, classified the intrusion detection system into two
types namely Network based IDS and Host IDS. The latter monitors all the activities of
inspected packets and resources that are being utilized by the programs. In case of any
alteration in networks, the user gets a network alert. HIDS is incorporated into the
computer framework to detect the abnormalities and protect the information from the
intruder. On the other hand, NIDS is the attribute function of target system. It uses anti-
thread software to control incoming and outgoing threads. It consists of signature-based
classification, which help in identifying the abnormalities by comparing it with log files
and previous signature.
In [2], the authors proposed an AI based Intrusion detection system using a deep
neural network. Neural networks consisting of four hidden layers and 100 hidden units
was used for the intrusion detection system. They used non-linear ReLU as the activation
function for the hidden layer neurons to enhance the model’s performance. They adopt
stochastic optimization method for learning in DNN. For the training and testing of their
model they used KDD CUP 99 dataset. They were able to reach the accuracy of 99% for
all the cases.
In [3], they have proposed a NIDS (Network Intrusion Detection System) which is
based on a feature selection method called Recursive Feature Addition (RFA) and bigram
technique. They tested the model on the ISCX 2012 data set. Moreover, they have
proposed a bigram technique to encode payload string features into a useful
representation that can be used in feature selection. They have also proposed a new
evaluation metric called that combines accuracy, detection rate and false alarm rate in a
way that helps in comparing different systems and selecting the best among them.
In [4], they have proposed a new intrusion detection system and addressed the
problem of adaptability in the field of intrusion detection. The proposed IDS is an
adaptive solution which provides the capability of detecting known and novel attacks as
well as being updated according to the new input from human experts in a cost-effective
manner.
[5], it deals with the evaluation and statistical analysis of labelled flow based
CIDDS-001 dataset used for evaluating Anomaly based (NIDS) Network Intrusion
Detection Systems. They basically used two techniques, k-means clustering and k-nearest
neighbor classification to measure the complexity in terms of prominent metrics. Based
on evaluation, they concluded that both k-means clustering k-nearest neighbor
classification perform well over CIDDS-001 dataset in terms of used prominent metrics.
Hence the dataset can be used for the evaluation of Anomaly based Network Intrusion
Detection Systems.
CHAPTER 3
CHAPTER 4
the generated web page – for example, PHP code can generate a web page's HTML code,
an image, or some other data. PHP has been widely ported and can be deployed on most
web servers on almost every operating system and platform, free of charge.
4.5.3 Database:
MySQL is the world's second most widely used open-source relational database
management system (RDBMS).It is named after co-founder Michael Widenius's
daughter. The SQL phrase stands for Structured Query Language.
The MySQL development project has made its source code available under the
terms of the GNU General Public License, as well as under a variety of proprietary
agreements. MySQL is owned by Oracle Corporation. And it is a popular choice of
database for use in web applications.
4.5.4 R LANGUAGE
R is a programming language and free software environment for statistical
computing and graphics supported by the R Foundation for Statistical Computing. The R
language is widely used among statisticians and data miners for developing statistical
software and data analysis. Polls, data mining surveys and studies of scholarly literature
databases, show substantial increases in popularity in recent years.
Big data analyst, Scientists, Engineers use R language for Statistical computing,
Graphics and analysis purpose. R is a most popular open source platform with different
version on Windows, Linux and mac OS. R is a comprehensive statistical platform
provides approximate 5000 packages and offers data analytics techniques. It is a powerful
platform for data analysis and exploration. In some cases when size of data is large and it
exceeds from its physical memory, then it performs very slow and gives poor results.
CHAPTER 5
SYSTEM DESIGN
5.1 Modules
1. Admin Module
2. User Module
3. Analysis Module
The user can search the product, find the details, analyse the products and get
serviced by the system.
In this module, the admin can analyse regarding the attacks and security issues
faced by the system and can get alerted on anomalies.
The components and the relation among the components are shown in figure 1, it
explains the major components and its infrastructure.
There is a common interface between the user and the core components of the
system, this interface provides access to main components.
The working can be briefly explained as, after logging in, the admin add the data
through application to the common interface such that it can be analyzed or processed on
different authority using their platform.
Register
Admin
Login
Order items
Users
Manage customer data
Request service
Request items
Send mails
LEVEL 1 – ADMIN
LOGIN
DELETE ITEM
ITEM
ADMIN
LOGIN GET
ALERTS ATTACK
VIEW
STATISTICS ATTACK
MANAGE ORDER
ORDERS
LEVEL 1 – CUSTOMER
View
ORDER
orders
LOGIN
Order ORDER
item
USER CANCEL
LOGIN
ORDER ORDER
Update CLOGIN
profile
ALERT
Get alerts
Logged in
Select products
Create order
Modify order
Submit order
Report Failure
Add to orders
Successfully ordered
Save to Database
Success Success
CHAPTER 6
SYSTEM IMPLEMENTATION
System Implementation (SI) is the stage where the theoretical design is converted into a
working system, the new system may be totally new, replacing an existing manual, or
automated system or it may be a major modification to an existing system. The system is
implemented using PHP 7 and MySql.
6.1.3 Database:
MySQL is the world's second most widely used open-source relational database
management system (RDBMS).It is named after co-founder Michael Widenius's
daughter. The SQL phrase stands for Structured Query Language.
The MySQL development project has made its source code available under the
terms of the GNU General Public License, as well as under a variety of proprietary
agreements. MySQL is owned by Oracle Corporation. And it is a popular choice of
database for use in web applications.
6.2 METHODOLOGY:
FEATURES
1. Data acquisition
We acquired our dataset of 3 different JSON formats and labeled our dataset. As we have
a large amount or reviews manually labeling was quite impossible for us. Therefor we
preprocessed our data and used Active learner to label the datasets. As amazon reviews
comes in 5-star rating based generally 3 star ratings are considered as neutral reviews
meaning neither positive nor negative. So we discard any review which contains a 3-star
rating from our dataset and take the other reviews and proceed to next step labeling the
dataset.
2. Data pre-processing
Tokenization: It is the process of separating a sequence of strings into individuals
such as words, keywords, phrases, symbols and other elements known as tokens. Tokens
can be individual words, phrases or even whole sentences. In the process of tokenization,
some characters like punctuation marks are discarded. The tokens work as the input for
different process like parsing and text mining.
Removing Stop Words: Stop words are those objects in a sentence which are not
necessary in any sector in text mining. So we generally ignore these words to enhance the
accuracy of the analysis. In different format there are different stop words depending on
the country, language etc. In English format there are several stop words.
POS tagging: The process of assigning one of the parts of speech to the given word is
called Parts of Speech tagging. It is generally referred to as POS tagging. Parts of speech
generally contain nouns, verbs, adverbs, adjectives, pronouns, conjunction and their sub-
categories. Parts of Speech tagger or POS tagger is a program that does this job.
3. Feature Extraction
Bag of word is a process of extracting features by representing simplified text or data,
used in natural language processing and information retrieval. In this model, a text or a
document is represented as the bag (multiple set) of its words. So, simply bag of words in
sentiment analysis is creating a list of useful words. We have used bag of words approach
to extract our feature sets. After preprocessed dataset we used pos tagging to separate
different parts of speech and from that we select nouns and adjectives and use those to
create a bag of words. Then run it through a supervised learning and find our results and
also the top used words from the review dataset.
4. Evaluate metrics
● Evaluate metrics play an important role to measure classification performance.
Accuracy measure is the most common for this purpose. The accuracy of a classifier on a
given test dataset is the percentage of those dataset which are correctly classified by the
classifier. And for the text mining approach always the accuracy measure is not enough to
give proper decision so we also took some other metrics to evaluate classifier
performance. Three important measures are commonly used precision, recall, F-measure.
Before discussing with different measures there are some terms we need to get
comfortable with-
TP (True Positive) represents numbers of data correctly classified
FP (False Positive) represents numbers of correct data misclassified
FN (False Negative) represents numbers of incorrect data classified as correct
TN (True Negative) is the numbers of incorrect data Classified
Precision: Precision measures the exactness of a classifier, how many of the return
documents are correct. A higher precision means less false positives, while a lower
precision means more false positive. Precision (P) is the ratio of numbers of instance
correctly classified from total.
6. Results representation
There were several machine learning algorithms used in our experiment like Naïve
Bayesian, Support vector Machine Classifier (SVC), Linear Regression (LR), Random
Forest and Decision Tree. We have conducted cross validation methods and 10 fold gave
the best accuracy. We conduct the best classifiers on 3 categories of product reviews and
see the results according to the evaluation measures. The classifiers were applied on
different feature selection process where the common features from TF-IDF and bag of
words gave best results for all the datasets.
6.3 Algorithm
Input:
Output:
Pre-processing ()
Convert to lower:
For w in words:
Strip:
If (w in stopwords)
Continue
Else:
Features=word in table
Return features
Vector List
If (similarity>threshold)
Match found
Classify (x, y)
6.4 Codes
<!DOCTYPE HTML>
<html>
<head>
<title>Karavali Shopping</title>
<link href="style.css" type="text/css" rel="stylesheet" />
<script src="js/jquery-1.11.1.min.js"></script>
<link rel="stylesheet" href="css/flexslider.css" type="text/css"
media="screen" />
<script src="js/responsiveslides.min.js"></script>
<script src="js/bootstrap.js"></script>
</head>
<body>
<!--start-header-section-->
<div class="header">
<div class="container">
<div class="header-top">
<div class="logo">
<h1><a href="index.html">
E- shopping </a></h1>
</div>
<div class="phone">
<h5><span class="glyphicon
glyphicon-lock" aria-hidden="true"></span> <a
HREF="LOGIN/login.php">Login / Sign up</a></h5>
</div>
<div class="clearfix"></div>
</div>
<div class="header-bottom">
<nav class="navbar navbar-default">
<div class="container-fluid">
<!-- Brand and toggle get grouped for
better mobile display -->
<div class="navbar-header">
</div>
<!-- Collect the nav links, forms, and other content for
toggling -->
<div class="collapse
navbar-collapse" id="bs-example-navbar-collapse-1">
<ul class="nav navbar-
nav cl-effect-16">
</ul>
</div><!-- /.navbar-
collapse -->
</div><!-- /.container-fluid -->
</nav>
</div>
</div>
</div>
<!--end header-section-->
<!--welcome-->
<div class="content">
<div class="welcome">
<div class="container">
<div class="welcome-grids">
<div class="col-md-6
welcome-grid">
<img
src="images/p1.jpg" class="img-responsive" alt="">
</div>
<div class="col-md-6
welcome-grid1">
<h2>Welcome to
Karavali Shopping store</h2>
<h4></h4>
<p>This is
an <strong> store</strong> for <strong>online sales </strong> that has
listings of various products along with their features.. This system
allows user to buy products online. System allow user to check various
articles submitted by admin.User can view features of each product and
can compare the products in order to purchase a better product.. </p>
<a href="#" class="button"> read
more</a>
<div
class="welcomes-grids">
</div>
</div>
</div>
<div class="clearfix"></div>
</div>
</div>
<div
class="clearfix"></div>
</div>
</div>
</div>
<!--welcome-->
<div class="slider1">
<div class="arrival-grids">
<ul id="flexiselDemo1">
<li>
<a href="#"><img
src="images/b3.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b4.png" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b5.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b6.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b7.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b8.jpg" alt=""/>
</a>
</li>
</ul>
<script type="text/javascript">
$(window).load(function() {
$("#flexiselDemo1").flexisel({
visibleItems: 4,
animationSpeed: 1000,
autoPlay: true,
autoPlaySpeed: 3000,
pauseOnHover:true,
enableResponsiveBreakpoints: true,
});
});
</script>
<script type="text/javascript"
src="js/jquery.flexisel.js"></script>
</div>
</div>
<!-- //slider -->
<!--features-->
<div class="feature">
<div class="container">
<h3>features</h3>
<div class="feature-
grids">
<div class="col-
md-3 feature-grid">
<div
class="feature-icon">
<span
class="glyphicon glyphicon-wrench" aria-hidden="true"></span>
</div>
<h4>Online
sales</h4>
<p></p>
</div>
<div class="col-
md-3 feature-grid">
<div
class="feature-icon">
<span
class="glyphicon glyphicon-dashboard" aria-hidden="true"></span>
</div>
<h4>customer support</h4>
<p></p>
</div>
<div class="col-
md-3 feature-grid">
<div
class="feature-icon">
<span
class="glyphicon glyphicon-record" aria-hidden="true"></span>
</div>
<h4>Delivery</h4>
<p></p>
</div>
<div
class="clearfix"></div>
</div>
</div>
</div>
<!--features-->
</div>
<iframe onload="this.width=screen.width;" height="1300"
src="BIKEX/items.php"></iframe>
` <div class="specials-section">
<div class="container">
<div class="specials-grids">
<div class="col-md-3 specials">
<h3>Items</h3>
<ul>
<li><a
href="#"></a></li>
</ul>
</div>
<div class="col-md-3 specials">
<h3>Services</h3>
<ul>
</ul>
</div>
<div class="col-md-3 specials">
<h3>Social</h3>
<ul>
<li><a
href="#">facebook</a></li>
<li><a
href="#">twitter</a></li>
<li><a
href="#">google+</a></li>
</ul>
</div>
<div class="col-md-3 specials">
<h3>About </h3>
</div>
<div class="clearfix"></div>
</div>
</div>
</div>
</div>
<!--footer-->
<div class="footer-section">
<div class="container">
<div class="footer-top">
<p>Copyright © 2019
Shop-App. All Rights Reserved |</p>
</div>
</div>
</div>
<!--footer-->
<div style="text-align: right;position: fixed;z-index:9999999;bottom:
0;width: auto;right: 1%;cursor: pointer;line-height: 0;display:block !
important;"><a title="Hosted on free web hosting 000webhost.com. Host
your own website for FREE." target="_blank"
href="https://www.000webhost.com/?
utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website&utm_co
ntent=footer_img"><img
src="https://cdn.000webhost.com/000webhost/logo/footer-powered-by-
000webhost-white2.png"
alt="www.000webhost.com"></a></div><script>function getCookie(e){for(var
t=e+"=",n=decodeURIComponent(document.cookie).split(";"),o=0;o<n.length;
o++){for(var i=n[o];"
"==i.charAt(0);)i=i.substring(1);if(0==i.indexOf(t))return
i.substring(t.length,i.length)}return""}getCookie("hostinger")&&(documen
t.cookie="hostinger=;expires=Thu, 01 Jan 1970 00:00:01
GMT;",location.reload());var
notification=document.getElementsByClassName("notice notice-success is-
dismissible"),hostingerLogo=document.getElementsByClassName("hlogo"),mai
nContent=document.getElementsByClassName("notice_content")
[0],newList=["Powerful and Easy-To-Use Control Panel.","1-Click Auto
Installer and 24/7 Live Support.","Free Domain, Email and SSL
Bundle.","5x faster WordPress performance","Weekly Backups and Fast
Response Time."];if(0<notification.length&&null!=mainContent){var
googleFont=document.createElement("link");googleFontHref=document.create
Attribute("href"),googleFontRel=document.createAttribute("rel"),googleFo
ntHref.value="https://fonts.googleapis.com/css?
family=Open+Sans:300,400,600",googleFontRel.value="stylesheet",googleFon
t.setAttributeNode(googleFontHref),googleFont.setAttributeNode(googleFon
tRel);var css="@media only screen and (max-width: 768px) {.web-hosting-
promo-
widget"),e.style.opacity=1},t.insertAdjacentElement("afterend",e)}if(win
dow.iFrameResize)e();else{var
n=document.createElement("script");n.type="text/javascript",t.insertAdja
centElement("afterend",n),n.onload=e,n.src="https://unpkg.com/iframe-
[email protected]/js/iframeResizer.min.js"}}()}</script></body>
</html>
MODEL CODE:
#Changing the attack type into boolean, 0 for normal and 1 for attack
#As it is a dependent Variable for the classification model
df$V42 <- ifelse(df$V42<23,1,0)
#Feature Scaling
train[-32] <- scale(train[-32])#[-32]expect dependent variable
test[-32] <- scale(test[-32])
#########################
CHAPTER 7
SYSTEM TESTING
In a software development project, errors can be injected at any stage during
development. The development of software involves a series of production activities
where opportunities for injection of human fallibility’s are enormous. Because of human
inability to perform and communicate with perfection, software development is
accomplished by a quality assurance activity.
A good test case is one that has a high probability of finding an as yet
undiscovered error.
The above objectives are simply a dramatic change in viewpoint. The move counter
to the commonly held view that a successful test is one in which no errors are found.
Testing cannot show the absence of defects, it can only show that software errors are
present.
1. knowing the specified function that a product has been designed to perform tests can be
conducted that demonstrate each function is fully operational at the save time searching
for errors in each function.
2. Knowing the internal working of a product, test can be conducted to ensure that “all
gears mesh”,
That is that internal operation performs according to the specification and all
internal components have been adequately exercised. The first test approach is called
Black box testing and the second approach is called White box testing.
White box testing, sometimes called Glass box testing design method that uses the
control method of the procedural design to derive test cases. Using white box testing
methods, the software engineer can derive test cases that:
1. Guarantee that all independent paths with in a module have been exercised at least
once.
4. Logical errors and incorrect assumptions are inversely proportional to the probability
that a program path will be executed.
5. Often believe that logical path not likely to execute when, in fact, it may be executed
on regular basis.
Each of these reasons provides an argument for conducting white box tests. Black
box testing, no matters how through, may miss the kinds of errors above. “Bugs lurk in
corners and congregate”. White-box testing is far more likely to uncover them.
The design of test cases for software and other engineered products can be as
challenging as initial design of the product itself. The tests that have the highest
likelihood of finding the most errors with a minimum amount of time and effort should be
designed.
A realistic goal for testing is to select a set of test cases. In the functional testing,
the test cases are decided solely on the basis of requirements. In the structural testing,
they are generated based on the actual code of the program or module to be tested.
In the test case specification we specify all the test cases that are used for the
system testing. First the different conditions that need to be test, along with the test cases
used for testing are given. The test cases have been selected using the functional
approach. The goal is to test the different functional requirements as specified in the
requirements documents. Test cases have been selected for both valid and invalid inputs.
A rich variety of test case design methods have evolved for software. These
methods provide the developer with a systematic approach to testing. Testing is an
important part of a software development. Any engineered product can be tested in one of
two ways.
1. Knowing the specified function that a product has been designed to perform.
The first test approach is known as black box testing and the second is white box Testing.
Black box testing focuses on the functional requirements of the software. That is
black-box testing enables the software engineer to drive set of input conditions that will
fully exercise all functional requirements of a program. In this project Black-box testing
has been successfully carried out and error were identified and corrected. Black-box
testing attempts to find errors in the following categories.
2. Interface errors.
Equivalence partitioning strives to define a test that uncovers the class of errors,
thereby reducing the total number of test cases that uncovers classes of errors, thereby
reducing the total number of test that uncovers classes of errors, thereby reducing the total
number of test cases that must be developed.
Code Testing
Program Testing
System Testing
Code Testing:
The code test has been conducted to test the logic of the program. Here, we have
tested with all possible combinations of data to find out logical errors. The code testing is
done thoroughly with all possible data available with library.
Program Testing:
Program testing is also called unit testing. The modules in the system are
integrated to perform the specific function. The modules have been tested independently,
later Assembled and tested thoroughly for integration between different modules.
System Testing:
System testing has been conducted to test the integration of each module in the
system .It is used to find discrepancies between the system and its original objective. It is
found that there is an agreement between current specifications and system
documentation.
Software Testing
The first step includes unit testing where in each module is tested to provide his
correctness, validity and also determine any missing operations. Errors are noted down
and corrected immediately. Unit testing is the import and major part of the project. So
errors are rectified easily in particular module and program clarity is increased. In this
project entire system is divided into several modules and is developed individually. So
unit testing is conducted to individual modules.
The second step includes integration testing. It need not be the case, the
software whose modules when run individually and showing perfect results, will also
show perfect results when run as a whole. The individual modules are clipped under this
major module and tested again and the results are verified.
The final step involves validation and testing which determines the software
functions as the user expected. Here also there may be some modifications. In the
completion of the project it is satisfied fully by the user.
Data can be lost across an interface, one module can have an adverse effort on the
other sub functions, when combined, may not produce the desired major functions.
Integrated testing is the systematic testing for constructing the uncover errors within the
interface. The testing was done with sample data. The developed system has run
successfully for this sample data. The need for integrated test is to find the overall system
performance
In the unit testing we test each module individually and integrate with the overall
system. Unit testing focuses verification efforts on the smallest unit of software design in
the module. This is also known as module testing. The module of the system is tested
separately. This testing is carried out during programming stage itself.
After performance of the validation testing, the next step is output testing. The output
displayed or generated by the system under consideration is tested by asking the user
about the format required by system.
CHAPTER 8
8.1 Screenshots
A simple web page is created allowing users to search and get results.
The login page consists of a page that allows the admin to enter the user name,
password and that has been sent to the user via mail. On successfully entering the details ,
the user will be taken to the home page.
CHAPTER 9
REFERENCES
[1] Rafath Samrin ; D Vasumathi , “Review on anomaly based network intrusion
[2] Jin Kim, Nara Shin, Seung Yeon Jo and Sang Hyun Kim , “Method of Intrusion
Detection using Deep Neural Network”. 2017 IEEE International Conference on Big Data
[3] Tarfa Hamed, RozitaDara, Stefan C.Kremer, “Network intrusion detection system
based on recursive feature addition and bigram technique”. Elsevier , Computers &
[4] Setareh Roshan , Yoan Michem Anton Akusok. Amaury Lendasse “Adaptive and
online network intrusion detection system using clustering and Extreme Learning
Machines”. Elsevier, Journal of the Franklin Institute Volume 355, Issue 4, March 2018,
Pages 1752-1779
[5] Abhishek Verma, Virender Ranga “Statistical analysis of CIDDS-001 dataset for
[7] Syam Akhil Repalle, Venkata Ratnam Kolluru. " Intrusion Detection System using AI
[8] Mahdi zamani. " Machine Learning Techniques for Intrusion Detection IEEE 2015.
[10] Md Nasimuzzaman Chowdhury and Ken Ferens, Mike Ferens. " Network Intrusion
[11] Rohit Kumar Singh Gautam ; Er. Amit Doegar." An Ensemble Approach for
İstanbul, Türkiye; A. Gökhan Yavuz ; M. Amaç Güvensan ; Khadija Hanifi ; Hasan Bank
Network intrusion detection using machine learning anomaly detection algorithms (2017)
[13] Ajit Kalekar, Niranjan Kshatriya, Snehal wadekar “Real time intrusion detection
[14] Rashmi Ravindra Chaudhari, Sonal Promod Patil, “The A Study on Data Mining &