I am still just dabbling in the shallower waters of machine learning and I am looking to compare the results of a Supervised algorithm (KNN) and Unsupervised algorithm (k-means) when it comes to identifying network based DOS attacks. I am stuck on how my data will fit into a k-means algorithm. In the tutorials I have seen (for example Long/Lat) the data very neatly plots onto a graph in which you can easily see how it clusters. In the link provided they use longitude and latitude locations as plot points.
In my data I have a time series which indicates when a packet was sent and I am interested in TCP and UDP packets. When there is a very high frequency of packets in a short amount of time there has been an attack. I am aware that I would have to convert the different packets types into numerical data with some form of encoding, but the issue is that when I imagine the plotted graph I can see it grouping TCP and UDP packets from the same time frame together - does that make sense?
I have included a sample of the data below. There is no attack happening in the first table, but there is a TCP flood underway in the second. So the question is how do you select the appropriate data and plot it so that a k-means algorithm can cluster it? I think its the Time feature and Protocol feature I need as the others don't really effect anything.
No. | Time | Source | Destination | Protocol | Length | Info |
---|---|---|---|---|---|---|
1 | 0 | 213.163.87.149 | 192.168.12.100 | UDP | 693 | 50019 > 55287 Len=651 |
2 | 0.009109 | 213.163.87.149 | 192.168.12.100 | UDP | 178 | 50019 > 55287 Len=136 |
3 | 0.03756 | 192.168.12.100 | 213.163.87.149 | UDP | 86 | 55287 > 50019 Len=44 |
4 | 0.040381 | 213.163.87.149 | 192.168.12.100 | UDP | 180 | 50019 > 55287 Len=138 |
5 | 0.040415 | 213.163.87.149 | 192.168.12.100 | UDP | 148 | 50019 > 55287 Len=106 |
6 | 0.051892 | 213.163.87.149 | 192.168.12.100 | UDP | 177 | 50019 > 55287 Len=135 |
7 | 0.066043 | 213.163.87.149 | 192.168.12.100 | UDP | 151 | 50019 > 55287 Len=109 |
8 | 0.068918 | 192.168.12.206 | 34.216.113.46 | TCP | 66 | 60588 > 443 [ACK] Seq=1 Ack=1 Win=501 Len=0 TSval=1855484038 TSecr=3288649611 |
9 | 0.069256 | 192.168.12.206 | 34.216.113.46 | TCP | 66 | 60576 > 443 [ACK] Seq=1 Ack=1 Win=501 Len=0 TSval=1855484038 TSecr=3288649618 |
10 | 0.06932 | 192.168.12.206 | 34.216.113.46 | TCP | 66 | 60574 > 443 [ACK] Seq=1 Ack=1 Win=501 Len=0 TSval=1855484038 TSecr=3288649615 |
11 | 0.070402 | 213.163.87.149 | 192.168.12.100 | UDP | 185 | 50019 > 55287 Len=143 |
12 | 0.088693 | 192.168.12.100 | 213.163.87.149 | UDP | 86 | 55287 > 50019 Len=44 |
13 | 0.089871 | 213.163.87.149 | 192.168.12.100 | UDP | 180 | 50019 > 55287 Len=138 |
14 | 0.095743 | 52.114.92.64 | 192.168.12.100 | TLSv1.2 | 388 | Application Data |
15 | 0.099751 | 213.163.87.149 | 192.168.12.100 | UDP | 128 | 50019 > 55287 Len=86 |
16 | 0.116736 | 213.163.87.149 | 192.168.12.100 | UDP | 182 | 50019 > 55287 Len=140 |
17 | 0.130674 | 213.163.87.149 | 192.168.12.100 | UDP | 180 | 50019 > 55287 Len=138 |
18 | 0.140124 | 192.168.12.100 | 213.163.87.149 | UDP | 86 | 55287 > 50019 Len=44 |
19 | 0.142975 | 213.163.87.149 | 192.168.12.100 | UDP | 128 | 50019 > 55287 Len=86 |
20 | 0.145032 | 192.168.12.100 | 52.114.92.64 | TCP | 54 | 51061 > 443 [ACK] Seq=1 Ack=335 Win=258 Len=0 |
21 | 0.153861 | 213.163.87.149 | 192.168.12.100 | UDP | 183 | 50019 > 55287 Len=141 |
22 | 0.167646 | 213.163.87.149 | 192.168.12.100 | UDP | 140 | 50019 > 55287 Len=98 |
23 | 0.172693 | 213.163.87.149 | 192.168.12.100 | UDP | 181 | 50019 > 55287 Len=139 |
24 | 0.18827 | 192.168.12.100 | 52.114.92.64 | TLSv1.2 | 235 | Application Data |
432 | 3.498621 | 213.163.87.149 | 192.168.12.100 | UDP | 200 | 50019 > 55287 Len=158 |
---|---|---|---|---|---|---|
433 | 3.511119 | 213.163.87.149 | 192.168.12.100 | UDP | 184 | 50019 > 55287 Len=142 |
434 | 3.531878 | 192.168.12.100 | 213.163.87.149 | UDP | 86 | 55287 > 50019 Len=44 |
435 | 3.53436 | 213.163.87.149 | 192.168.12.100 | UDP | 181 | 50019 > 55287 Len=139 |
436 | 3.534412 | 213.163.87.149 | 192.168.12.100 | UDP | 197 | 50019 > 55287 Len=155 |
437 | 3.557786 | 213.163.87.149 | 192.168.12.100 | UDP | 185 | 50019 > 55287 Len=143 |
438 | 3.562951 | 213.163.87.149 | 192.168.12.100 | UDP | 320 | 50019 > 55287 Len=278 |
439 | 3.567072 | 213.163.87.149 | 192.168.12.100 | UDP | 178 | 50019 > 55287 Len=136 |
440 | 3.571375 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37964 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961609 TSecr=0 WS=128 |
441 | 3.571607 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37966 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961609 TSecr=0 WS=128 |
442 | 3.571798 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37968 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961609 TSecr=0 WS=128 |
443 | 3.572238 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37970 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961610 TSecr=0 WS=128 |
444 | 3.572498 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37972 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961610 TSecr=0 WS=128 |
445 | 3.573037 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37964 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |
446 | 3.573142 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37966 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |
447 | 3.573265 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37968 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |
448 | 3.573391 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37970 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |
449 | 3.574408 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37972 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |
450 | 3.574634 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37974 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961612 TSecr=0 WS=128 |
451 | 3.575003 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37976 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961612 TSecr=0 WS=128 |
452 | 3.575606 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37978 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961612 TSecr=0 WS=128 |
453 | 3.575643 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37980 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961613 TSecr=0 WS=128 |
454 | 3.576023 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37974 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |
455 | 3.576138 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37976 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |
456 | 3.576495 | 192.168.12.206 | 192.168.12.131 | TCP | 74 | 37982 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961613 TSecr=0 WS=128 |
457 | 3.57701 | 192.168.12.131 | 192.168.12.206 | TCP | 54 | 80 > 37978 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0 |