How rpcodes121/flow-based-ml-ids works
This repository is a notebook-based research project for flow-based machine-learning intrusion detection, rather than a packaged runtime service. Its tree suggests stages for dataset analysis, feature preparation, model training and threshold calibration. The README gives no workflow details, and the sampled source contains only dependencies, so connections between notebooks and data or models cannot be verified; the graph therefore groups the main activities without asserting their wiring.
Components 14
Data analysis
- Exploratory analysis
analysis/cicIds2018/prelim_analysis.ipynb - Data cleaning
analysis/data_cleaning.ipynb - Dataset setup
analysis
Feature preparation
- Preprocessing
models/data_related/full_feat_preprocess.ipynb - Normalization
models/data_related/normalization.ipynb - Feature pruning
models/data_related/pruning.ipynb - Feature importance
models/data_related/feature_imp_calc.ipynb
Model training
- MLP training
models/MLP/MLP_train.ipynb - SVM training
models/svm/svm_train.ipynb - TabNet training
models/tabnet/train_tabnet.ipynb - XGBoost training
models/xgboost/xgboost_train.ipynb - XGBoost tuning
tuning/xgboost/tuning.ipynb
Threshold calibration
- TabNet calibration
Threshold_calibration/tabnet/calibration.ipynb - XGBoost calibration
Threshold_calibration/xgboost/calibration_fullSet.ipynb