Network traffic anomaly detection over time

The brief

Some attacks show up as unusual traffic over time rather than single bad packets. Build traffic time series from flow records, detect anomalous periods with statistical and machine-learning methods, and compare them against the known attack periods. Good looks like: clear time series, several methods compared on the same labelled periods, and an alert view.

What you will build

1. Aggregate flows into traffic time series
2. Detect anomalies with z-scores and seasonal methods
3. Try Isolation Forest and an autoencoder
4. Compare methods against known attack periods
5. Build an alert timeline view

Free, open data to build it with

• CIC-IDS2017 ↗ Canadian Institute for Cybersecurity

Check each dataset's licence before you publish your work. Your mentor gives your team its own version of the brief (data, scope or region), so every team's project is its own.