Reference no: EM132224466
Data analytics for intrusion detection
Learning Outcomes
a) Evaluate intelligent security solutions based on data analytics
b) Analyse and interpret results from descriptive and predictive data analysis
Assignment Overview
You are hired by the Purehacking Pty Ltd (a popular penetration testing company in Australia) to consult an accounting company which requested advanced instruction detection system for their internal network. The accounting firm had suffered malicious hacking attack which compromised their client's information and released it on the dark web. The reputation of the accounting company was severely damaged, and the managing director of the accounting firm was determined not to tolerate any such future attacks that can jeopardize his business.
Your supervisor at Purehacking wishes to try out an advanced data analytic tool to improve the network instruction detection at the accounting company.
Your supervisor has asked you to test out a few data analytics techniques available on the market and evaluate their performance in network intrusion detection.
To provide a fair comparison of security performance, your supervisor is recommending you consider a network security benchmark data such as the popular KDD99 dataset.
Your supervisor will make recommendation to the accounting firm based on your technical findings and report.
Your tasks are to:
1. Perform intrusion detection using the available data analytics techniques using WEKA or other platforms.
2. Evaluate the performance of data analytic techniques in intrusion detection using comparative analysis
3. Recommend the security solution using the selected data analytic technique.
In consultation with your lecturer, you are to choose at least three data analytic techniques for network intrusion detection and prepare a technical research report. Follow the marking guide to prepare your report.
Section 1: Data Analytic Tools and Techniques
In this section, your task is to complete and write a report on the following:
1. Install/deploy the data analytic platform of your choice (on Win8 VM on VirtualBox).
2. Demonstrate the use of at least two data analytic techniques (e.g. decision tree, clustering or other techniques) - you are free to use any sample testing data to demonstrate your skills and knowledge.
3. Lab demonstration: Must explain how each tool technique works in your lab prior to week 11. Data can be anything including Iris data set.
Section 2: Data Analytic for Network Intrusion Detection
You are to perform the following tasks and write a full report on your outcomes:
1. Convert the benchmark data suitable for the data analytic tools and platform of your choice. Explain the differences in the available data format for data analytics.
2. Select the features with rationale (external reference or your own reasoning).
3. Create training and testing data samples
4. Evaluate and select the data analytic techniques for testing
5. Classify the network intrusion given the sample data
6. Evaluate the performance of intrusion detection using the available tools and technologies (e.g. confusion matrix).
7. Identify the limitation of overfitting
8. Evaluate and analyse the use of ensemble tools
9. Recommend the data analytic solution for the network intrusion detection.
10. Discuss future research work given time and resources