ABSTRACT

Cyber-attack, via cyberspace, targeting an enterprise's use of cyberspace for the

purpose of disrupting, disabling, destroying, or maliciously controlling a
computing environment/infrastructure; or destroying the integrity of the data or
stealing controlled information. The state of the cyberspace portends uncertainty
for the future Internet and its accelerated number of users. New paradigms add
more concerns with big data collected through device sensors divulging large
amounts of information, which can be used for targeted attacks. Though a
plethora of extant approaches, models and algorithms have provided the basis
for cyber-attack predictions, there is the need to consider new models and
algorithms, which are based on data representations other than task-specific
techniques. However, its non-linear information processing architecture can be
adapted towards learning the different data representations of network traffic to
classify type of network attack. In this paper, we model cyber-attack prediction
as a classification problem, Networking sectors have to predict the type of
Network attack from given dataset using machine learning techniques. The
analysis of dataset by supervised machine learning technique(SMLT) to capture
several information‘s like, variable identification, uni-variate analysis, bi-variate
and multi-variate analysis, missing value treatments etc. A comparative study
between machine learning algorithms had been carried out in order to determine
which algorithm is the most accurate in predicting the type cyber Attacks. We
classify four types of attacks are DOS Attack, R2L Attack, U2R Attack, Probe
attack. The results show that the effectiveness of the proposed machine learning
algorithm technique can be compared with best accuracy with entropy
calculation, precision, Recall, F1 Score, Sensitivity, Specificity and Entropy.

2
 TABLE OF CONTENT

SL.NO TITLE PAGE.NO

01

02 EXISTING SYSTEM 12
2.1 DRAWBACKS

INTRODUCTION 13
03 3.1 DATA SCIENCE
3.2 ARTIFICIAL INTELLIGENCE

04 MACHINE LEARNING 19

05 PREPARING DATASET 21

06 PROPOSED SYSTEM 21
6.1 ADVANTAGES

07 LITERATURE SURVEY 22

08 SYSTEM STUDY 30
8.1 OBJECTIVES
8.2 PROJECT GOAL
8.3 SCOPE OF THE PROJECT

09 FEASIBILITY STUDY 37

10 LIST OF MODULES 39

PROJECT REQUIREMENTS 39
11 11.1 FUNCTIONAL REQUIREMENTS
11.2 NON-FUNCTIONAL REQUIREMENTS

3
12 ENVIRONMENT REQUIREMENT 40

13 SOFTWARE DESCRIPTION 41
13.1 ANACONDA NAVIGATOR
13.2 JUPYTER NOTEBOOK

14 PYTHON 51

15 SYSTEM ARCHITECTURE 63

16 WORKFLOW DIAGRAM 64

17 USECASE DIAGRAM 65

18 CLASS DIAGRAM 66

19 ACTIVITY DIAGRAM 67

20 SEQUENCE DIAGRAM 68

21 ER – DIAGRAM 69

22 MODULE DESCRIPTION 70
22.1 MODULE DIAGRAM
22.2 MODULE GIVEN INPUT EXPECTED
OUTPUT

23 DEPLOYMENT (GUI) 94

24 CODING 95

25 CONCLUSION 141

26 FUTURE WORK 142

4
 LIST OF FIGURES

SL.NO TITLE PAGE.NO

01 SYSTEM ARCHITECTURE 63
02 WORKFLOW DIAGRAM 64
03 USECASE DIAGRAM 65
04 CLASS DIAGRAM 66
05 ACTIVITY DIAGRAM 67
06 SEQUENCE DIAGRAM 68
07 ER – DIAGRAM 69

5
 LIST OF SYSMBOLS

S.NO NOTATION NOTATION DESCRIPTION

NAME

Class Name
1. Class Represents a
-attribute
collection of
+ public
-attribute similar entities
-private
+operation grouped together.
# protected
+operation

+operation

Associations
2. Association Class A NAME Class B represents static
relationships

Class B
between classes.
Class A
Roles represents
the way the two
classes see each
other.

3. Actor It aggregates

6
 several classes into
a single classes.

Class A Class A Interaction

4. Aggregation between the system

Class B Class B and external

environment

Relation(uses)
5. uses Used for additional
process
communication.

6. Relation Extends
(extends) extends relationship is used
when one use case
is similar to
another use case
but does a bit
more.

7. Communication Communication
between various
use cases.

8. State State State of the

process.

7
9. Initial State Initial state of the
object

10. Final state Final state of the

object

11. Control flow Represents various

control flow
between the states.

12. Decision box Represents

decision making
process from a
constraint

Interaction
13. Use case Uses case between the system
and external
environment.

Represents
14. Component physical modules
which is a

8
 collection of
components.

Represents
15. Node physical modules
which are a
collection of
components

A circle in DFD
16. Data represents a state
Process/State or process which
has been triggered
due to some event
or action.

Represents external
17. External entity entities such as
keyboard, sensors
etc.

18. Transition Represents

communication

9
 that occurs
between processes.

Represents the
19. Object Lifeline vertical dimensions
that the object
communications.

20. Message Message Represents the

message
exchanged.

10
 CHAPTER 1

1.1 INTRODUCTION

Input techniques can be partitioned into two kinds: misconstruing and

deformity location. A wide range of known (irresistible) assaults can be
distinguished by evaluating the normal interruption pace of the framework for
checking the means of misconception. In the case of something surprising
occurs, the framework initially learns the ordinary profile and afterward records
every one of the components of the framework that don't match the set up
profile. The principle advantage of discovery is the maltreatment of the
capacity to identify new or surprising assaults at high rates, making it hard to
distinguish.

The upside of having the option to identify uncommon things is the capacity to
recognize new (or startling) assaults that convey many advantages. Procedures
dependent on innovation pipelines utilized in different ventures. We give
general data to the investigation of traffic data and of information, which can be
used for targetedattacks. A comparative study between machine learning
algorithms had been carried out in order to determine which algorithm is the
most accurate in predicting the type cyber Attacks. We classify four types of
attacks are DOS Attack, R2L Attack, U2R Attack, Probe attack. The results
show that the effectiveness of the proposed machine learning algorithm
technique can be compared with best accuracy with entropy calculation,
precision, Recall, F1 Score, Sensitivity, Specificity and Entropy. for the
location of street mishaps utilizing the significant distance-course of-the-street

The proposed technique utilizes tests dependent on the issue of eliminating

traffic data via online media (Facebook and Twitter): this movement gathers
sentences connected with all traffic exercises, for example, traffic stops or
street terminations. The quantity of starting handling strategies is presently
executed. Breathing, signal presentation, POS signal, partition, and so forth to
change the data acquired in the inherent structure. The information is then
consequently shown as "traffic" or "traffic" utilizing the latent Dirichlet
allocation (LDA) calculation. Vehicle enrollment data is isolated into three

11
kinds; great, terrible and impartial. The response to this classification is the
expression enraptured (positive, negative, or unbiased) as for street sentences,
contingent upon whether or not it is traffic. The bag-of-words (BoW) is
presently used to change each sentence over to a solitary hot code to take care
of bi-directional LSTM organizations (Bi-LSTM). In the wake of preparing, a
multi-stage muscle network utilizes softmax to arrange sentences as indicated
by area, vehicle experience, and sort of polarization. The proposed strategy
contrasts the preparation of various machines and the high-level preparing
techniques as far as precision, F scores, and different standards

1.2 Existing System:

They proposed first to create a contrastive self-supervised learning to the

anomaly detection problem of attributed networks. CoLa, is mainly consists of
three components: contrastive instance pair sampling, GNN-based contrastive
learning model, and multiround sampling-based anomaly score computation.
Their model captures the relationship between each node and its neighbouring
structure and uses an anomaly-related objective to train the contrastive learning
model. We believe that the proposed framework opens a new opportunity to
expand self-supervised learning and contrastive learning to increasingly graph
anomaly detection applications. The multiround predicted scores by the
contrastive learning model are further used to evaluate the abnormality of each
node with statistical estimation. The training phase and the inference phase. In
the training phase, the contrastive learning model is trained with sampled
instance pairs in an unsupervised fashion. After that the anomaly score for each
node is obtained in the inference phase.

Disadvantages:

1. The performance is not good and its get complicated for other networks.

12