# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
## 4 Methodology and Implementation
### Intrusion Detection  
There are two widely used intrusion detection techniques: anomaly and signature-based detection. An anomaly-based detection approach is based on the hypothesis that any intrusive activity will be distinctive from normal activities. Meanwhile, signature-based detection assumes that each attack has an associated pattern that can be referenced for identification. Before visualizing the effects of a cyberattack, a model has to be adept in various attack detection including DoS [53], which is the limitation of signature-based detection techniques. The collection of intrusion signatures for comparison is not only _reactive_ but also onerous with the current growing number of threats.  
We innovate our network anomaly detection by analyzing the temporal behavior of network traffic, focusing on the dynamic nature of network interactions, allowing a real-time adaptation to what is considered normal behavior while enabling the detection of anomalies not just based on static patterns but on evolving network conditions. By extracting sufficient TCP connections and network packets from our Wireshark capture, we enhance the traditional anomaly detection model to include a novel data analytics-based technique. The novelty of our model is highlighted in the ability to dynamically interpret network behavior and giving granular analysis of network traffic patterns to improve conventional anomaly detection through open-source tools.  
Therefore, as part of MO-2, we select the anomaly-based detection technique for our intrusion detection based on the available dataset and how it significantly influences data analytics-based techniques. We adopt this consideration from successfully improved performance reviews in [54], using temporal data to handle anomaly detection. After extracting sufficient TCP connections and network packets from our Wireshark capture, we transition our model to include a novel data analytics-based anomaly detection technique. To differentiate success rates between intruders and benign hosts based on targeted services running, we combine part a) failure rate (FR) and part b) established connections (ECs) to develop a failure rate and established connections-based network intrusion detection system named FREC-NIDS. Within the scope of our proposed model, the failure rate and established connections-based network intrusion detection system (FREC-NIDS) employs a unique blend of network data analytics to identify potential threats. By definition, FREC-NIDS analyzes network traffic through two primary lenses as described: the failure rate (FR) of connection attempts and the volume of successfully established connections (ECs). This dual analysis allows for enhanced detection of sophisticated intrusion attempts.  
We consider that malicious hosts have a higher number of failed connections attempting many different host connections within a short period than non-malicious hosts. Malicious connection requests are mostly rejected because not all hosts would be running the targeted service, resulting in a low connection success rate. By contrast, non-malicious hosts attempt connection requests with near certainty for positive response, resulting in a high success rate.