Network intrusion detection with explainable alerts

The brief

A company's security team is drowning in alerts from rule-based tools. They want a machine-learning intrusion detection system that recognises attack types (DoS, port scans, brute force, web attacks) in flow records, raises fewer false alarms, and tells the analyst why each alert fired. Good looks like: strong detection across attack types (not just the common ones), an alert view with explanations, and a test of how it copes with traffic it has not seen.

What you will build

1. Clean and balance the flow records; handle rare attack classes
2. Engineer features and compare classical and deep models
3. Evaluate per attack class and on a held-out day of traffic
4. Explain alerts with SHAP and group similar alerts
5. Build an analyst dashboard with filters and alert detail
6. Report limits, false-alarm costs and how to retrain

Free, open data to build it with

• CIC-IDS2017 ↗ Canadian Institute for Cybersecurity
• NSL-KDD ↗ Canadian Institute for Cybersecurity

Check each dataset's licence before you publish your work. Your mentor gives your team its own version of the brief (data, scope or region), so every team's project is its own.