# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
## 7 Conclusions  
In light of the challenges posed by intricate NIDS schemes, there has been a surge in network breaches. Multilayered strategies that embed cyber visualization of NIDS alerts have emerged as a countermeasure, albeit accompanied by inherent constraints. Recognizing that most cyberattacks stem from unauthorized network connections, we introduced a novel NIDS, which gleans network information through processes easily replicated from network scanning utilities. Our approach monitors TCP connections, handshake FR, and the count of ECs at specific intervals, generating alerts to identify benign or malicious network connections. In our strategy, a visual-interactive prototype is designed to highlight suspicious connections, with color-coded outcomes based on cyberattack and cyber-defense rates. This enhancement provides cyber-analysts with a more informed decision-making tool, especially in situations where rapid termination of malicious connections prompts attackers to constantly switch targets. Central to our defense approach is the introduction of a verified report on compromised hosts, presented on the primary network controller. This is complemented by the deceptive broadcast of incorrect packet destination routes to compromised entities. Once a false route is accepted by the malicious hosts and packets forwarded, these packets are subsequently dropped. Our visual tool provides the status of networked hosts' availability at given intervals rather than mere visualization of cyberattack effects on the physical world, i.e., non-technical space. Our experiment shows a significant improvement in \(F_{1}\) score compared with other models [15, 16, 17, 18, 19], which have a lowest performance score of 86.5%. Our model showed only a 0.3% FPR and a high \(F_{1}\) score of 97.9%. However, we are limited in differentiating high-level network components, such as hubs and network switches, that might not operate the same as data point networked hosts. Nonetheless, main network controllers have in the past been poorly configured and breached as high-priced attack targets, necessitating special attention. Our future work will cluster network components differently, including network computing hosts handled diversely like main network controllers. Testing our model in expansive networks will yield more detailed data on network events, potentially enhancing our false positive rate metrics. A controlled network environment allowed us to closely monitor the model's performance and fine-tune its detection mechanisms but does not offer the ability to capture important computation complexity metrics. Recognizing the importance of this aspect for real-world applications, our future works will include processing time and memory usage processing as the model analyzeslive network traffic over time. This will set up the stage for future investigations into its computational complexity. This next step is crucial for ensuring FREC-NIDS meets the dynamic demands of modern network security challenges. Our future plans also involve expanding our model to include behavioral analysis for anomaly detection that will enhance the model's ability to analyze patterns of behavior within the network traffic and adapt to new patterns of network behavior over time. Furthermore, as an expansion of our mitigation strategy, future iterations of our model will consider integration with other security systems such as open-source firewalls and intrusion prevention systems. This integrated approach will advance our model's fingerprint of malicious connections in a holistic defense approach. Conceptualization, E.M. and D.R. ; methodology, E.M. and D.R. formal analysis, E.M. and D.R. ; validation, E.M. and D.R. ; Evaluation, E.M. and D.R. All authors have read and agreed to the published version of the manuscript. This work is partly supported by the U.S. Air Force Research Lab through Radiance Technologies, the U.S. NSF under grants CNS 1650831, and HRD 1828811, and by the U.S. Department of Homeland Security under grant DHS 2017-ST-062-000003.