Network Anomaly Detection

A machine learning project that detects network intrusions and classifies attack types using the NSL-KDD dataset. Built as part of an exploration into applying ML techniques to cybersecurity.

Overview

This project trains a Random Forest classifier to:

• Binary classification: Detect whether network traffic is normal or an attack
• Multi-class classification: Identify the specific type of attack (DoS, Probe, Privilege Escalation, Unauthorized Access)

Dataset

NSL-KDD Dataset - An improved version of the KDD Cup 1999 dataset for network intrusion detection.

• 125,973 training records
• 43 features per record

Attack Categories

Label	Category	Examples
0	Normal	Regular network traffic
1	DoS	neptune, smurf, teardrop, pod
2	Probe	ipsweep, nmap, portsweep, satan
3	Privilege Escalation	buffer_overflow, rootkit, perl
4	Unauthorized Access	ftp_write, guess_passwd, imap

Tech Stack

• Language: Python 3.13
• Libraries: scikit-learn, pandas, numpy, matplotlib, seaborn, nltk
• Environment: Jupyter Notebook (Miniconda)
• Model: Random Forest Classifier

Project Structure

Network-Anomaly-Detection/
│
├── network_anomaly.ipynb        # Main Jupyter notebook
├── network_anomaly_model.joblib # Saved trained model
├── README.md                    # Project documentation
└── .gitignore                   # Git ignore rules

Workflow

1. Load & Explore Dataset ↓
2. Data Cleaning & Preprocessing
   • Handle missing/invalid values
   • One Hot Encode categorical features (protocol_type, service)
   • Map attack types to numeric labels ↓
3. Feature Engineering
   • Combine encoded + numeric features
   • Split into train/validation/test sets (56% / 24% / 20%) ↓
4. Model Training
   • Random Forest Classifier (random_state=1337) ↓
5. Evaluation
   • Accuracy, Precision, Recall, F1-Score
   • Confusion Matrix (heatmap)
   • Classification Report ↓
6. Save Model
   • Exported using joblib

Results

The model achieves strong performance on the NSL-KDD dataset:

Metric	Score
Accuracy	~99%
Precision	~99%
Recall	~99%
F1-Score	~99%

How to Run

1. Clone the repository:

git clone https://github.com/rohan282/Network-Anomaly-Detection.git
cd Network-Anomaly-Detection

2. Install dependencies:

pip install pandas numpy scikit-learn matplotlib seaborn joblib

3. Download the NSL-KDD dataset and place it in the project root.

4. Launch Jupyter:

jupyter lab

5. Open and run network_anomaly.ipynb

Loading the Saved Model

import joblib

# Load model
model = joblib.load('network_anomaly_model.joblib')

# Predict on new data (must be preprocessed the same way)
predictions = model.predict(new_data)

Author

Rohan Madiratta
LinkedIn

License

This project is open source and available under the MIT License.