Ganesh-Nadkarni/network-anomaly-detection

Network Traffic Anomaly Detection

Detect network intrusions / anomalies using machine learning on the NSL-KDD dataset.

Model

The best-performing model is a Gradient Boosting Classifier, selected automatically based on F1 score.

Performance

Metric	Score
Accuracy	80.64%
F1 Score	80.05%
ROC-AUC	96.25%

Classification

The model performs binary classification:

• Normal
• Attack

Dataset

NSL-KDD — Network Intrusion Detection

The model was trained using the NSL-KDD dataset.

Dataset source: https://www.kaggle.com/datasets/hassan06/nslkdd

Input Features

The model uses 41 features:

duration
protocol_type
service
flag
src_bytes
dst_bytes
land
wrong_fragment
urgent
hot
num_failed_logins
logged_in
num_compromised
root_shell
su_attempted
num_root
num_file_creations
num_shells
num_access_files
num_outbound_cmds
is_host_login
is_guest_login
count
srv_count
serror_rate
srv_serror_rate
rerror_rate
srv_rerror_rate
same_srv_rate
diff_srv_rate
srv_diff_host_rate
dst_host_count
dst_host_srv_count
dst_host_same_srv_rate
dst_host_diff_srv_rate
dst_host_same_src_port_rate
dst_host_srv_diff_host_rate
dst_host_serror_rate
dst_host_srv_serror_rate
dst_host_rerror_rate
dst_host_srv_rerror_rate

Models Trained

Three machine learning models are evaluated:

Model	Accuracy	F1 Score	ROC-AUC
Random Forest	77.07%	75.44%	96.20%
Gradient Boosting	80.64%	80.05%	96.25%
Logistic Regression	75.39%	74.07%	87.14%

The Gradient Boosting Classifier is automatically selected as the best model based on F1 score.

Model Files

model/
├── best_model.pkl
├── scaler.pkl
├── label_encoders.pkl
└── feature_names.pkl

File Description

• best_model.pkl — trained Gradient Boosting classifier
• scaler.pkl — fitted StandardScaler
• label_encoders.pkl — encoders for categorical features
• feature_names.pkl — list of the 41 input features

Quick Start

1. Install dependencies

pip install pandas numpy scikit-learn matplotlib seaborn joblib kaggle

2. Download the dataset

Option A — Kaggle CLI:

kaggle datasets download -d hassan06/nslkdd
unzip nslkdd.zip -d data/

Option B — Manual:

1. Download the NSL-KDD dataset.
2. Extract it into a folder called data/.
3. You should have:

data/
├── KDDTrain+.txt
└── KDDTest+.txt

3. Train the model

python train.py

The training process evaluates Random Forest, Gradient Boosting, and Logistic Regression and saves the best model to:

model/best_model.pkl

4. Predict

Interactive mode:

python predict.py

Demo mode:

python predict.py --demo

Batch CSV mode:

python predict.py --csv my_traffic.csv

Output Plots

train.py generates diagnostic plots:

1. 01_model_comparison.png — model comparison
2. 02_roc_curves.png — ROC curves with AUC
3. 03_confusion_matrix.png — confusion matrix
4. 04_feature_importance.png — feature importance
5. 05_class_distribution.png — attack type distribution

predict.py generates:

• prediction_results.png — prediction visualization
• batch_summary.png — batch prediction summary

Project Structure

network_anomaly_detection/
├── train.py
├── predict.py
├── README.md
├── data/
│   ├── KDDTrain+.txt
│   └── KDDTest+.txt
├── model/
│   ├── best_model.pkl
│   ├── scaler.pkl
│   ├── label_encoders.pkl
│   └── feature_names.pkl
└── plots/
    └── *.png

Technologies

• Python
• Scikit-learn
• Pandas
• NumPy
• Matplotlib
• Seaborn
• Joblib
• NSL-KDD

Use Case

This project can be used as a machine-learning-based network intrusion detection system to classify network traffic as normal or attack.

Disclaimer

This model is intended for educational and research purposes. Performance may vary on real-world network traffic because the model was trained and evaluated on the NSL-KDD dataset.