0
$\begingroup$

Made a neural network using TensorFlow's Keras that is supposed to match an IP to one of the 7 type of vulnerabilities and give out what type of vulnerability that IP has.

model = tf.keras.models.Sequential([
  tf.keras.layers.Flatten(),
  tf.keras.layers.Dense(50, activation=tf.nn.relu),
  tf.keras.layers.Dense(7, activation=tf.nn.softmax)
])

model.compile(optimizer='adam',
              loss='sparse_categorical_crossentropy',
              metrics=['accuracy'])

model.fit(xs, ys, epochs=500)

xs is the list of IPs and ys is its corresponding vulnerability from 0 to 6 (seven in total).

The output for this remains the same for every input, i.e.,:

[[0.22258884 0.20329571 0.36828393 0.11352853 0.04444532 0.02388807 0.02396955]]

$\endgroup$
7
  • $\begingroup$ What do you mean by output? Output of what? The fit function? $\endgroup$
    – fswings
    Sep 22 '19 at 14:39
  • $\begingroup$ @fswings no I mean model.predict("ANY IP") function $\endgroup$ Sep 22 '19 at 14:57
  • $\begingroup$ As the seven probabilities for all classes add up to exactly 100%, I would guess that the model didn't find any connections between the IPs and the vulnerabilities. Then it would just always return the natural distribution of the vulnerabilities in the training data to "optimize" the model results (Do 22,52 % of the IPs in training have the first vulnerability?). If you can tell us the model outputs eg. loss/ accuracy or plot the training process, we could probably tell more ... $\endgroup$
    – rayon
    Sep 22 '19 at 20:02
  • $\begingroup$ The probabilities add to 100% by default due to softmax; this has nothing to do with the reported problem $\endgroup$
    – desertnaut
    Sep 22 '19 at 20:49
  • $\begingroup$ If a human expert looked at your training data, do you think they could figure out the patterns between IP addresses and vulnerabilities, and correctly identify new IP addresses? If the answer to this question is "no", then you may need to include more information. What format are your IPs in? $\endgroup$ Sep 22 '19 at 21:24
0
$\begingroup$

Most probably, this is because your model is way too simple - a single 50-node hidden layer for a 7-class problem does not sound adequate.

Try adding more hidden layers (and not quite sure if you really need a Flatten layer just after the input), e.g.,:

model = tf.keras.models.Sequential([
 tf.keras.layers.Dense(100, activation=tf.nn.relu),
 tf.keras.layers.Dense(50, activation=tf.nn.relu)
 tf.keras.layers.Dense(50, activation=tf.nn.relu),
 tf.keras.layers.Dense(7, activation=tf.nn.softmax)
])

Experiment with the exact number and size of the layers.

$\endgroup$
0
$\begingroup$

It depends on the representation of the IP address. If you are feeding the IP address with those dots in it, it might perform worse. Rather, I would suggest splitting the IP into 4 separate inputs (separated by dots) and feed the 4 inputs individually to the network, and then evaluate.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.