# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
## 2 Related Work  
Network complexities and cost implications are pivotal in network security models. Due to technical challenges, including cost and network complexities, many existing models are grouped on techniques, algorithms, system types, and available datasets [14]. Our spectrum of scope in this section considers approaches based on network data types and, more so, transmission control protocol (TCP) connections that form the crux of several NIDS approaches. To distinguish between these, we categorize them based on their treatment of TCP data in terms of feature extraction and classification. Approaches such as [15, 16, 17, 18, 19] emphasize extracting features from TCP connections and labeling data. These processed data are then utilized to classify network traffic as malicious or benign. * Anomaly Detection with AdaBoost: The AdaBoost-based solution [15] deploys an online AdaBoost algorithm, leveraging both extracted network data and global detectors. * Boosted Decision Trees: Both Ruan et al. [16] and the Hierarchical SOM method [17] use a similar foundational model but enrich it by integrating boosted decision trees, leading to multiple decision classifiers. * Support Vector Machines (SVM): refs. [18, 19] exploit the SVM algorithm post extensive training from TCP feature extracted data. Particularly, ref. [19] melds kernel principal component analysis and the genetic algorithm, while the multi-level hybrid SVM and extreme learning machine (ELM) introduces a modified \(k\)-means algorithm. Each method offers its unique strengths, but a common lacuna is the absence of an affordable, nonproprietary, _on-the-fly_ data probing and collection mechanism that operates sans extensive training. Our proposal fills this gap using _open-source service discovery tools_ for network extraction and intrusion detection. Additionally, our model does not require extensive training and is differentiated with a visualization module offering enhanced portrayal of NIDS outputs. Addressing SYN-ACK-based attacks is a topic of much debate. The brute-force method, as described in [20], aims to inflate the data structure for TCP connections awaiting acknowledgment, making it cumbersome for average attacker requests to sustain bandwidth constraints. While effective, this method is not without its pitfalls. The survey [21] flags issues like sluggish response times during connection look-ups, owing to the sheer volume of TCP data structures housed in vast spans of protected kernel memory. Moreover, unwarranted memory allocation might inadvertently modify TCP signaling behaviors. Our proposal counters these challenges by offering an economical and simplified approach. By monitoring TCP connections via open-source tools, we boost intrusion detection efficiency, merging the dual strengths of combined failure rates and pre-established TCP connections. Visualization remains an under-explored territory in intrusion detection. Our method stands out by integrating a visual module that augments information processing, an emphasis not universally applied. For instance, Bhardwaj and Singh [22] leverage supervised data mining for network data extraction but offer limited details on live packet capture parameters, performance metrics, or validation data. In contrast, our approach ensures transparency by utilizing _service discovery tools_ for automated network data mining. Other notable endeavors include Ohnof et al. 's [23] methodology, which focuses on visualizing IP addresses related to cyberattacks by analyzing attack timing, source, and type with network sensors yet primarily targets Internet-worm attacks with a narrow visual scope. Ulmer et al. [24] develop a web-based prototype analyzing Geo-IP data changes to identify unusual behavior, focusing on historical threat source visualization rather than networked assets' current state.