ML & Security Engr | B.Tech CS @ Amrita. Build ML defense tools & FastAPI backends. Stack: Python, PyTorch, FastAPI.

github

Aayan Hasan  • Peerlist

<h3>About the Project</h3><p>This project is a real-time cybersecurity visualization system that monitors global DDoS attacks. It utilizes machine learning to predict threat levels and displays these attacks on an interactive 3D globe. The system fetches malicious IP addresses from AbuseIPDB, predicts threat levels using a Random Forest ML model, and visualizes the attacks with 3D effects powered by Three.js.</p><h3>Key Features:</h3><ul><li><strong>Real-time Threat Intelligence:</strong> Integrates with AbuseIPDB to gather live data on malicious IP addresses.</li><li><strong>Machine Learning Classification:</strong> Employs a Random Forest model for accurate threat level prediction, achieving 100% accuracy on the test set.</li><li><strong>IP Geolocation:</strong> Accurately geolocates IP addresses and utilizes caching for improved performance.</li><li><strong>Interactive 3D Globe Visualization:</strong> Features a dynamic 3D Earth with visual representations of attacks, including glowing spheres and pulsing beams, color-coded by threat level.</li><li><strong>User-Friendly Interface:</strong> Includes an information panel with live statistics, attack details on hover, and control options for fetching data and auto-refreshing.</li><li><strong>Deployment Ready:</strong> Supports deployment on platforms like Render.com, GitHub Pages, and Docker.</li></ul><h3>Technology Stack:</h3><ul><li><strong>Backend:</strong> FastAPI, scikit-learn, httpx, Pandas, NumPy, joblib, uvicorn</li><li><strong>Frontend:</strong> Three.js, WebGL, OrbitControls, JavaScript ES6+</li><li><strong>External APIs:</strong> AbuseIPDB (threat intelligence), ipinfo.io (geolocation)</li></ul><p>This project offers a comprehensive solution for visualizing and understanding global DDoS attack patterns, combining real-time data with advanced machine learning and interactive 3D graphics.</p>

GitHub - Aayan2024/ddos-attack-map · GitHub

<h3>Project Overview</h3>
<p>This project, NetReaper, is a machine learning security hackathon project focused on developing an adversarial-resilient intrusion detection system using the NSL-KDD dataset. It employs a three-stage pipeline complemented by an interactive Streamlit dashboard for visualization and analysis.</p>

<h3>Architecture and Workflow</h3>
<ul>
<li><strong>Stage A: Baseline Classification</strong>: Implemented in stage_a_baseline.py, this stage establishes a foundational intrusion classification model. Outputs include accuracy metrics, confusion matrices, ROC curves, and feature importance charts.</li>
<li><strong>Stage B: Adversarial Simulation</strong>: This stage, handled by attack_simulation.py and run_stage_b_attack.py, simulates adversarial attacks to test the resilience of the detection system. It can operate in dummy or real-data modes, supporting models like Random Forest (rf) and XGBoost (xgb). The output includes adversarial samples (X_adversarial_samples.csv).</li>
<li><strong>Stage C: Anomaly Safety Net</strong>: Utilizing stage_c_anomaly.py and stage_c_test.py, this stage implements an Isolation Forest model to act as a safety net, detecting anomalies. It generates a trained model (stage_c_isolation_forest.pkl) and SHAP summary plots (stage_c_shap_summary.png).</li>
<li><strong>Streamlit Dashboard</strong>: The app.py script powers an interactive dashboard that integrates the outputs from all stages. The current version includes cached data and model artifacts for efficiency, a unified adversarial path, a tabbed layout for different views (Dashboard, Detailed Analysis, Raw Data), and metric deltas to show attack impact and recovery.</li>
</ul>

<h3>Dataset and Setup</h3>
<p>The project utilizes the KDDTrain_with_headers.csv dataset, with the 'label' column as the target. Setup involves installing dependencies via pip install -r requirements.txt.</p>

<h3>Integration and Conventions</h3>
<p>The anomaly convention in Stage C is -1 for anomaly and 1 for normal. The final defensive decision rule classifies an event as an attack if the classifier predicts an attack (1) OR the anomaly detector flags it as an anomaly (-1).</p>

<h3>Documentation</h3>
<p>Additional documentation is available in PROJECT_EXPLANATION.md, context.md, and handover.md, providing technical details, implementation status, and handover information.</p>