Network Traffic Anomaly Detection Using Machine Learning

Summary

In this presentation, Magna Kri and teammates Vijay, Wami, and Graa discuss their project on network traffic anomaly detection using machine learning. The team introduces the need for adaptive security systems in response to cyber threats. They demonstrate the use of K-means clustering and other machine learning techniques to detect anomalies in network traffic data, focusing on packet sizes and IP addresses. The presentation covers code implementation, methodology, challenges faced, results, and future work, emphasizing the need for advanced, real-time monitoring to combat evolving cyber threats effectively.

Takeaways

• 📡 The presentation focuses on network traffic anomaly detection using machine learning to enhance network security.
• 📊 Key sections of the presentation include introduction, methodology, code demonstration, results, challenges, future work, and references.
• 🔒 Cybersecurity challenges arise from evolving technologies and sophisticated cyber attacks targeting network vulnerabilities.
• 💻 Machine learning is being utilized to identify subtle network traffic anomalies, offering adaptive threat detection.
• 📈 K-means clustering is the primary algorithm used for detecting anomalies in network traffic, analyzing packet size, IP addresses, and other features.
• 🔧 The code demonstration highlights Python-based anomaly detection, employing machine learning techniques such as eigenvalues, eigenvectors, and data normalization.
• 📉 The team utilized clustering models, including K-means and DBSCAN, to categorize network traffic data and identify anomalies.
• 📉 Results show the model effectively detecting anomalies with a purity of 95%, although challenges with data quality and scalability remain.
• ⚙️ Future work includes improving data quality, adopting more advanced techniques, enabling real-time monitoring, and explaining AI decision-making.
• 🔍 The conclusion emphasizes the importance of machine learning in improving cybersecurity and detecting network anomalies, with continuous improvement necessary to keep up with evolving cyber threats.

Q & A

What is the main objective of the project discussed in the transcript?

The main objective of the project is to develop a comprehensive network traffic anomaly detection system using state-of-the-art machine learning techniques to detect potential cyber threats by identifying anomalies in network traffic patterns.

Why are traditional security measures like firewalls insufficient for modern network security?

Traditional security measures such as firewalls and intrusion detection systems rely on predefined rules and signatures, making them vulnerable to sophisticated attacks that use evasion tactics. Additionally, as networks grow in complexity, manually updating rules becomes more difficult.

How do machine learning techniques improve network anomaly detection?

Machine learning algorithms learn patterns inherent in network traffic data and can detect subtle deviations from normal behavior, allowing for more adaptive and dynamic threat detection. This enables identification of potential security breaches or performance anomalies.

What machine learning technique is used in the project for anomaly detection?

The project uses K-means clustering, an unsupervised machine learning technique that groups data points into clusters based on features such as packet size and IP address. Deviations from normal clusters are flagged as potential anomalies.

What role do eigenvalues and eigenvectors play in the project’s anomaly detection process?

Eigenvalues and eigenvectors are used to analyze the properties of the Laplacian matrix in the network, helping identify the underlying structure of the network traffic data. This allows the system to detect important features and patterns in the data.

What are some of the challenges mentioned in detecting anomalies in network traffic?

Challenges include dealing with messy data (e.g., missing values, outliers), handling large volumes of data in real-time, and ensuring the anomaly detection system can effectively keep up with evolving cyber threats.

What are the future improvements suggested for the project?

Future improvements include enhancing data quality, exploring advanced machine learning techniques, implementing real-time monitoring, and focusing on explainable AI to better understand and interpret the system's decisions.

What clustering evaluation metrics were used to assess the quality of the K-means clusters?

The evaluation metrics used include purity, recall, F1 score, and entropy. These metrics help assess the effectiveness of the clustering, with high purity indicating good clustering and low entropy reflecting less randomness.

How was the K-means algorithm implemented in the project’s code?

The K-means algorithm was implemented by initializing centroids, assigning data points to the nearest centroid based on Euclidean distance, recalculating the centroids, and repeating this process until convergence. The model was run for different values of K (e.g., 7 and 15) to find the optimal number of clusters.

How are anomalies detected using the clustering results?

Anomalies are detected by identifying data points that are far from the centroids of the clusters. These points are likely to represent abnormal network traffic and are flagged for further investigation to determine if they are malicious.

Outlines

00:00

🧑‍🏫 Introduction to Network Traffic Anomaly Detection

The speaker introduces the team (Magna, Vijay, and Wami) and provides an overview of their project on network traffic anomaly detection using machine learning. The presentation covers the contents of the talk: introduction, methodology, code demonstration, results, challenges, and future work. They explain how digital transformation has increased the need for secure networks but also opened new vulnerabilities for cyberattacks. Traditional security methods such as firewalls and intrusion detection systems, while effective, struggle to keep up with sophisticated attacks. The focus of the project is to develop a machine learning-based anomaly detection system that can dynamically detect deviations in network traffic, providing a more adaptive and efficient way to manage cyber threats.

05:01

💻 Code Overview for Anomaly Detection

The speaker, Graa, introduces the code developed for anomaly detection in network traffic, focusing on analyzing data like packet sizes and IP addresses. The method used is K-means clustering, a machine learning algorithm that groups data points into clusters based on shared features. Graa explains the process of importing necessary libraries, defining functions, and using matrices to represent the network’s structure. The code analyzes network traffic and flags deviations from normal behavior as potential anomalies, which may indicate malicious activity. The speaker outlines how mathematical concepts like eigenvalues and norms are used to identify key data features, normalize the data, and apply K-means clustering.

10:02

🧮 K-Means Clustering Algorithm for Network Traffic

Vijay takes over to explain the K-means clustering algorithm, a popular unsupervised learning method for grouping similar data points. The algorithm selects initial centroids randomly and assigns data points to the nearest cluster based on distance, iterating until convergence. The speaker demonstrates how the code imports libraries, downloads datasets, and converts categorical data into numerical values for processing. The goal is to create clusters of network traffic data based on 42 features, such as packet size and service type. The class defined for K-means clustering contains various methods for centroid initialization, cluster assignment, and model fitting, ensuring effective clustering of the data.

15:03

📊 Clustering Performance Evaluation

This section delves deeper into the evaluation and implementation of the K-means clustering process. The speaker discusses clustering on training data using a list of values for K (7 and 15), which are iterated to optimize results. They explain how the code uses only a portion of the dataset for training and evaluates the model based on metrics like F1 score, entropy, and purity. These evaluations help determine the quality of clustering. By analyzing the relationship between F1 score, purity, and entropy across different cluster sizes, the speaker shows that increasing the number of clusters improves the purity of the model, although overfitting is noted. The project also uses a normalized cut method for special clustering.

20:05

🚨 Anomaly Detection and Evaluation

The speaker discusses the process of detecting anomalies in the network traffic using the K-means clustering algorithm. By clustering the data and calculating distances between data points, anomalies are identified as data points that don't fit well into any cluster. The model detected 107 anomalies, and the speaker highlights the evaluation methods used to assess the clustering’s effectiveness, including purity, recall, F1 score, and conditional entropy. They also introduce the DBSCAN algorithm, which clusters data points based on density and is used to identify anomalies in a noisier dataset. Overall, the results show a successful detection of anomalies in the training data.

⚙️ Challenges and Future Work in Anomaly Detection

The speaker, Vami Sadya, outlines the challenges the team faced in building the anomaly detection system. Handling large amounts of messy data with missing values or outliers was a significant issue, as the detection system struggled to keep up. To improve the model, future work will focus on enhancing data quality, exploring advanced machine learning techniques, and implementing real-time monitoring for quicker detection of new threats. The speaker emphasizes the importance of explainable AI, which can provide clarity on why the system flags certain activities as anomalies. This will be crucial for improving the model's usability and effectiveness.

📈 Conclusion and Final Thoughts

In the conclusion, the speaker reflects on the project’s success in using machine learning techniques such as K-means, SVM, and neural networks for anomaly detection in network traffic. They highlight the importance of clean data and careful evaluation to achieve reliable results. Looking ahead, the team aims to further integrate machine learning into cybersecurity practices, continuously improving the system to match the evolving landscape of cyber threats. This project demonstrates the need for ongoing research to enhance machine learning capabilities in anomaly detection and cybersecurity.

Keywords

💡Network Traffic

Network traffic refers to the exchange of data packets across a computer network. In the context of the video, it is the subject of analysis for detecting anomalies that could indicate security threats. The script mentions analyzing 'packet sizes and IP addresses' to identify patterns that deviate from the norm, which are then flagged as anomalies.

💡Anomaly Detection

Anomaly detection is the identification of patterns in data that do not conform to expected behavior, which can indicate potential security breaches or system issues. The video discusses using machine learning to detect anomalies in network traffic, highlighting its importance in cybersecurity.

💡Machine Learning

Machine learning is a subset of artificial intelligence that enables systems to learn from and make decisions based on data. The script emphasizes the use of machine learning algorithms to learn patterns in network traffic data, which helps in dynamically detecting threats that traditional rule-based systems might miss.

💡K-Means Clustering

K-means clustering is a machine learning algorithm used for dividing a dataset into a specified number of clusters based on similarity. The script describes using K-means to group data points into clusters, with anomalies being data points that are far away from the majority of data points within the clusters.

💡Cyber Attacks

Cyber attacks are attempts to damage, disrupt, or gain unauthorized access to a computer system or network. The video script discusses the importance of robust network infrastructure to protect against the looming threat of cyber attacks, emphasizing the need for advanced security measures beyond traditional firewalls.

💡Data Integrity

Data integrity refers to the accuracy and consistency of data over its entire lifecycle. The script mentions that cyber attacks can compromise data integrity, which is a key concern that anomaly detection systems aim to protect against by identifying unusual activities that could lead to data corruption or loss.

💡Feature Selection

Feature selection is the process of choosing the most relevant features (or variables) from a dataset for use in model training. The script refers to selecting features like 'duration, protocol, service flag, source bytes, destination bytes' from network traffic data for analysis, which are critical for the machine learning model to identify anomalies effectively.

💡Cybersecurity

Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. The video's main theme revolves around enhancing cybersecurity through machine learning-based anomaly detection in network traffic, showcasing the ongoing need for innovative solutions to combat cyber threats.

💡Overfitting

Overfitting occurs when a model learns the detail and noise in the training data to an extent that it negatively impacts the model's performance on new data. The script suggests a potential overfitting issue where the model performs better on training data than on testing data, indicating a need for further refinement to generalize well.

💡Real-Time Monitoring

Real-time monitoring refers to the continuous observation of systems or networks to detect and respond to issues as they occur. The script mentions the future work of implementing real-time monitoring to adapt quickly to new threats, highlighting the importance of timely detection and response in cybersecurity.

💡Explainable AI

Explainable AI is a subfield of artificial intelligence that focuses on creating systems whose actions can be easily understood by humans. The script touches on the need for 'expansible AI' or explainable AI in the context of anomaly detection systems, to ensure that the reasons behind identifying certain activities as anomalies are clear and justifiable.

Highlights

Introduction to network security challenges and the importance of robust and secure network infrastructure.

The threat of cyber attacks and network breaches alongside the benefits of interconnected systems.

Traditional security measures like firewalls and intrusion detection systems are limited by predefined rules.

The growing interest in machine learning techniques for network anomaly detection.

Machine learning algorithms can learn patterns in network traffic data for dynamic threat detection.

The project's aim to develop a comprehensive network traffic anomaly detection system using state-of-the-art machine learning techniques.

The code for anomaly detection is written in Python and is based on the assumption that normal network traffic follows certain patterns.

Use of K-means clustering to group data points into clusters based on network traffic properties.

The importance of data normalization to ensure equal weight of features in the K-means algorithm.

Identification of anomalies through data points assigned to clusters far away from the norm.

Explanation of the K-means clustering algorithm and its application in grouping similar data points.

The process of centroid initialization, cluster assignment, and centroid update in K-means.

Demonstration of the code that implements K-means clustering for anomaly detection in network traffic.

Challenges faced during the project, such as detecting unusual activity in messy data and the need for real-time monitoring.

Future work includes improving data quality, exploring advanced machine learning techniques, and developing explainable AI.

Conclusion on the effectiveness of machine learning techniques like K-means, SVM, and neural networks for detecting unusual activity.

The need for ongoing research and development to enhance machine learning-based anomaly detection systems in cybersecurity.

References from Google Scholar and comparison of different models used in the project for accuracy and F1 score.

Transcripts

hello Professor this is Magna kri so

today my teammates Vijay wami graa and I

are going to talk on network traffic

anomaly detection using machine learning

so the next

slide uh so the contents includes

introduction methodology code

demonstration results challenges and

future work conclusion and reference

next slide

please uh introduction to network

security challenge uh the digital

Technologies rapidly has uh re

revolutionized uh how we communicate

contact business and access information

with this digital transformation robust

and secure network infrastructure has

become uh Paramount however the looming

threat of uh cyber attacks and network

uh breaches uh come along uh side the

numerous benefits of the interconnector

systems uh and the actors uh constantly

seek to explorit

uh vulnerabilities in network

architectures compromising data uh

Integrity privacy and uh system

availability uh traditional security

measures such as uh firewalls and uh

intr uh detection systems uh how how

long been the Frontline defense against

cyber threats while these tools are

effective to some extent they often r on

predefined rules and signatures uh

making them uh suspectable uh to

evocation tactics employed by

sofisticated attracts uh moreover as

Network in infrastructure go grow in

complexity and scale manually crafting

and updating rules be uh becomes

increasing increasingly daunting uh in

response to these challenges uh a

growing interest has been in uh machine

learning techniques for uh Network

anomaly detection uh unlike rule based

approaches machine learning algorithms

can learn patterns and behaviors uh

inheritant uh in network traffic data

enabling more uh adaptive uh and dynamic

threat detection uh by analyzing vast

amount of uh data uh machine learning

models can identify uh subtle uh

deviations from normal Behavior Uh

indicative of potential security

breaches or performance uh anomal

anomalies uh this product uh like this

project aims to uh develop a

comprehension Network a traffic anomaly

detection system using state of the art

machine learning techniqu uh this report

outlines the methodology techniques and

uh Evolution uh criteria for developing

the anomaly detection system next will

be continued uh by the Le will be

continued by graa

braa are you

there yes

yes

so code is written in the python for

machine learning likely to detect

anomalies in network traffic so this

code is based on the idea that normal

Network traffic will follow certain

patterns so by analyzing data such as

packet sizes and IP addresses the code

can identify patterns that deviate from

the norm so these deviations are then

flagged as anomalies which could be a

sign of malicious activity coming to the

code snippet uh it uses a machine

learning technique called K means

clustering this involves grouping data

points into a specific number of

clusters uh that are defined by K so

each data point is assigned to the

cluster that is most likely resembles

based on it features in this case the

features are the properties of the

network traffic such as packet size and

IP

address so the code first Imports the

necessary libraries including numi for

numerical operations and SEC learn for

machine learning then it defines a

function to perform the anomaly

detection so here this function takes

three arguments uh one is lation Matrix

uh which the it represents the

connections between the nodes in the

network and the second one is B dig

Matrix uh in which it represents the

degree of each node in the network and

finally the third one k which represents

the number of clusters to use the K

means algorithm so here the function

first calculates the aen values and aen

vectors of the lation Matrix aen values

and aen vectors are mathematical

Concepts used to analyze the properties

of Matrix so here in this case they help

to identify the underlying structure of

the network traffic data and next um the

function sorts the Aon values and Aon

vectors uh and this is done to identify

the most important features of the data

now next it takes this first k a vectors

and computes the norm of each row so the

norm is a mathematical concept that

represents the itude of a vector in this

case it is used to measure the strength

of the signal in each data

point the function then normalizes the

data uh this means uh it scales the data

to a common range uh this is the

important thing because it ensures the

all the features have an equal weight in

the K means algorithm finally the

function uses the K means algorithm to

Cluster the data points so here the C

algorithm partitions the data points

into clay

K clusters and the data points are

assigned to the cluster that they mostly

uh reassemble uh based on their features

so the code can be used to identify

anomalies in the network traffic so data

points that are assigned to clusters

that are far away from the data points

are likely to be anomalies these

anomalies can be investigated further to

determine uh if they are malicious

something like that and of course uh

this is a simplified code uh but the

actual code is more complex so that will

be includes other steps um hopefully

this gives a basic understanding how the

code works yeah and next will be

continued

by our team

mate yeah hello hi uh my name is

vij uh let me just Che uh to the code

demonstration uh before that uh in our

project we have used the the algorithm

that we have used is C in clustering let

me just go through the cin algorithm in

brief so cin algorithm clustering is a

popular unsupervised machine learning

algorithm used for passing data set into

set of K clusters the goal of K means

clustering is to group the similar data

points together and discover underlying

patterns or structures in the data let's

see how the algorithm actually works so

the algorithm starts by randomly

selecting K data points from the data

set as the initial cluster centroids

these centroids acts as the initial

representative for each cluster then

each data point in the data set is

assigned to the nearest cent based on

the Su distance metric this typically we

can calculate this Distance by ukl and

distance so the data points are grouped

into K clusters based on which centroid

they are closest to then after all the

data points have been assigned to

clusters the CID are recalculated as the

mean all of all the data points assigned

to each cluster this step updates the

cented positions then we are will repeat

the step two and step three repeatedly

until the convergence criteria are met

uh convergence occurs when the C no

longer changes significantly between

iterations when a maximum number of

iterations reach in the final the once

the convergence is achieved the

algorithms output final cluster

assignment and SIDS uh let me just take

to the code

demonstration

um so this is our code uh where we

import uh necessary libraries like numai

and pandas M Li escal and metrics and

scii kit special distance and we'll

start by downloading the data sets that

we have like we have used the three data

sets here uh we have downloading these

data sets from the kddc pickup

so so here we are importing those data

sets into uh data

frames and in the data set we have 42 uh

feature selection features like uh

duration prototype service flag Source

bites destination bites land rank

fragment urgent and so on we have until

42 types of features in the data set so

in the next step we have defined a

method called convert categorical

columns so this function converts

categorical columns in a data frame into

numerical represents ensuring that

machine learning algorithms can process

them effectively it also provides the

option to store and refuse mappings

between categorial values and the

numerical values representation across

the multiple function

cells and

here we are converting those columns I

mean category columns into numerical

columns and then here here comes the

clustering using K

meanss so here in this uh code we define

a class K means which implements K means

clustering algorithm in the in in the

first initialization here in the

initialization method this I mean this

is the Constructor this initialize the

centroid attributes To None which will

hold the cented values after fitting the

model and the next one is centered

initialization this function initialize

centroids method randomly selects K data

points from the training data as the

initial centroids it ensures that each

Cent is unique to avoid

duplication and the next one is

U the method cluster assignment the

compute cluster indicates this method

calculate the distance between each data

point and the centroids then assign each

data point to the nearest

centroid and the next method that we

have is assigning uh assigned clusters

so this method organize the data points

into clusters based on the assigned

centroids and the next one we have uh

update centroids method so this update

centroids method recalculates the

centroids based on the mean of the data

points within the each cluster

and the next one is the kin method this

one uh iteratively perform the cluster

using a a loop assignment and the Cent

update steps until the converges are

reaching the maximum number of

iterations and the next we have uh print

cluster info so this method is basically

prints the method display information

about the size of clusters for a given

value of K

and the next we have a compute SS so

these compute SS SS means a sum of

scared errors so this method calculat

the sum of scared errors which is

measure of how spread out of the data

points within the Clusters and the next

we have the model fitting so this model

fitting uh fits the kyin model to the

training data and it performs multiple

restarts to find the best best set of

cids that minimum the SSC and the next

method that we have in the class is the

predict method so this predict method

assigns testing data points to the

Clusters based on the fitting

centroids and the next get centroids

method so this will return uh the

centroids learn based during the fitting

process so overall in this uh this class

and encapsulates the K means clustering

algorithm that providing methods for

fitting the model making predictions and

accessing the learning centroids it also

include functionality for evaluating the

quantity of uh quality of clustering

results using SS and printing cluster

information and uh in the next step we

have a um clustering definition like the

value for the k k so here we have taken

the value uh value of K is 7 and 15 so

these are the optimal values for uh

kin's clustering so we have initialized

the K value by 7 and

15 and in The Next Step uh we are uh

this code will Loop that iterates over

each value of K in the K value list and

this this Loop

iterates um or each uh in in in the case

in in in this case the list of contains

that we have initialized here is 7 and

15 so this Loop runs the K means

clustering algorithm multiple times each

time with a different value of K and it

stores the resulting cluster models in

the kin's dictionary that we have

defined here so allowing to access the

models later for the further further uh

analysis and

visualization and here we have we have

using

0.15% of data set that he used for the

training and here in the uh training

data and training uh uh this code will

essentially split the data into a small

subset for training and uh discuss the

rest of the data and the next we have a

method called normalized cut so this

function will essentially perform the

special clustering using the normalized

cut criteria which aims to parion the

data into K clusters based on the igon

vectors of the LA plasm Matrix special

cluster in is a powerful technique for

clustering data with complex structures

or

nonion and here we uh here this is the

function call of for the yo method so

when we call the function so this is the

output that we have this output

summarize that uh clustering process and

provide insights into how the data

points are grouped into clusters based

on their Sim similarities in the lower

Dimension space defined by the

normalized ion vectors that we have here

so moving on to the next

um here we have the uh relationship

between the Matrix we have some Matrix

called Purity recall F1 score and

entropy and and here we are defining the

uh relationship between the F1 score and

the K value here in the first graph we

are plotting uh relationship between F1

and F1 score and K for uh using training

data and testing data so as you can see

by seeing this the graph we can say that

in both the training and testing data

there seems to be a positive correlation

between Purity and K this means that as

the number of clusters increase the

Purity also increasing so uh compared to

uh training and testing the training

data lines cons uh consist instantly

scores higher in Purity than the testing

data lies so this suggest that model

might be overfitting the training data

and the next we have entropy and K the

relationship between entropy and K

so uh this this one uh we can see by

looking at the graph we can say the

entropy is decreasing so the entropy

generally decreases as the number of

clusters increase this means that the

data becomes more ordered or pure as we

increase the number of clusters so this

is because with the more clusters the

data points are grouped into smaller and

more specific cluster reducing

Randomness and here in this uh and the

next one we have

kin so this code performs cin clustering

on the training data assign data points

to the cluster and evaluate the

clustering results using some evaluation

methods and the next one we have uh

compute anomalies so this uh this

compute anomalies will take uh two

parameters that one one is the Clusters

and the next one is uh I mean sorry

three so cluster data and labels and it

will return return the number of

anomalies that we have detected so here

uh while after the training data uh we

have detected a, and

uh, one 1,100 107 anomalies that we have

detected here and we are printing those

anomalies here so and also here in the

normalized cut evaluation like U we have

uh for the K value cluster sizes so we

have the Purity is 95 uh 0.95 that means

95% of Purity and the recall is uh 0.25

and F1 score is 0.32 the so the

condition entropy will is the

0.26 and the next we have uh another uh

print evalutions and

um the dbsn evaluations so dbsc

evaluation is nothing but density based

special clustering of application with

noise is a it's a popular clustering

algorithm that doesn't require specific

number of cluster beforehand instead it

groups that together closely packed into

based on the two parameters a epon and

which denotes the radius with the search

for neighboring points and Main samples

which specify the number of points

required to form a dens region so in the

final results that we got here is like

uh in the training data we have detected

1,17

anomalies using this uh training data

yeah uh this is uh the working working

uh demonstration of a project let me go

back to the this presentation

slide yeah so and the next continuation

slide will be uh explained by

Manu uh hi everyone uh this is vami

sadya uh I'm going to explain about the

challenges and the future work uh during

this project uh we have faced the

challenge

changes like uh detecting unusual

activity in networks is tough because

the data we have might be messy with

things like missing values or outer lers

plus when we are dealing with a lot of

data our detection system might struggle

to keep uh keep up solving these issues

is crucial to making sure our anomal

detection systems can effectively

protect digital systems from Cy cyber

threats uh uh and the future work the

fure work we can develop in this project

is uh data quality Advanced Techniques

and uh real monitoring and uh uh

expansible AI so coming to the data

quality we need to find better ways to

clean up our data before we analyze it

uh to improve the accuracy of our

detection system and next coming to

Advanced Techniques uh we should explore

more advanced method in machine learning

to better find anomaly in network data

real real time monitoring making our

systems able to adapt quickly to new

threads by monitoring network activity

in real time uh expansible AI uh it's

important to be able to understand why

our detection systems think something is

wrong so we need techniques that can exp

explain the decisions clearly and now

coming to conclusion part uh VI can you

please go to next slide um confirmation

of efficient

we found that using machine learning

techniques like kin svm and neural

networks is really effective for

sparting unusual activity in networks uh

making making sure our data is clean and

evaluating our detection systems

carefully is crucial for reable results

uh looking forward we need to uh keep

improving our system to keep up with the

Challen with the changing world of cyber

security this means um integrated

machine machine learning more deeply

into how we protect digital systems this

work emphasizes the ongoing need for

research and development to enhance the

capabilities of machine learning based

anomaly detection systems in cyber

security so next

slide yeah uh these are the references

uh we have taken from the Google Scholar

uh sites and uh uh we have uh taken the

uh supervisor learning machine learning

and everything we have

covered for this project and we have

compared with the other models too uh

and we have given and we have taken the

accuracy F1 score everything uh we are

compared with every model in this uh

project uh uh as explained by Vijay uh

thank you