🔐 Network Intrusion Detection System (NIDS) - Unsupervised Learning

This project implements a Network Intrusion Detection System using unsupervised machine learning techniques like Isolation Forests and Autoencoders to detect anomalous patterns in network traffic. These anomalies could signal security breaches, malware, or system malfunctions.

📌 Objective

To identify potential threats or unusual behavior in network traffic without requiring labeled data, leveraging the KDD Cup 1999 dataset for training and evaluation.

🧠 Techniques Used

• Isolation Forest: Tree-based algorithm that isolates anomalies rather than profiling normal instances.
• Autoencoder (Keras): Deep neural network trained to reconstruct input; anomalies are identified based on high reconstruction error.

📊 Dataset

• KDD Cup 1999 Dataset (10% subset)
• Contains simulated network connections labeled as either normal or one of several attack types.

⚙️ Features

• Preprocessing of categorical and numerical network features
• Feature normalization using StandardScaler
• Dual anomaly detection pipelines:
  • IsolationForest with contamination tuning
  • Deep Autoencoder using reconstruction error
• Export of labeled anomalies to CSV for analysis

📁 Output

• anomaly_results_kdd.csv contains:
  • anomaly_isolation_forest: -1 = anomaly, 1 = normal
  • anomaly_autoencoder: 1 = anomaly, 0 = normal

🚀 Future Enhancements

• Real-time network traffic analysis
• Anomaly visualization using PCA/t-SNE
• Performance comparison with supervised classifiers (e.g., SVM, Random Forest)
• Containerization (Docker) for deployment

📦 Installation

pip install pandas scikit-learn tensorflow keras