Network intrusion detector with explanations

The brief

Security teams want fewer, better alerts. Train gradient boosting on labelled network flows to detect attacks, pay special attention to rare attack types, and explain each alert so an analyst knows why it fired. Good looks like: per-attack metrics, rare classes handled, and explanations per alert.

What you will build

1. Clean the flow records and labels
2. Handle rare attack classes
3. Train gradient boosting and evaluate per attack type
4. Explain alerts with SHAP
5. Write up false alarms and missed attacks

Free, open data to build it with

• UNSW-NB15 ↗ UNSW Canberra

Check each dataset's licence before you publish your work. Your mentor gives your team its own version of the brief (data, scope or region), so every team's project is its own.