Data Analytics Techniques and Tools for Network Security

This document discusses data analytics techniques and tools for network security. It covers Weka analytics tool, Zoho Analytics, Microsoft Power BI, decision tree, back propation algorithm, quantitative analysis, qualitative analysis, clustering, pcap files, Bro IDS tool, confusion matrix, and more. It also includes information on data formats, training and testing data samples, and performance of intrusion detection.

1
Network security
Student’s Name:
Institution Affiliation:

2
Section 1
A data analytics platform helps in playing out the activities on data examination as a total
bundle, so as to perform information examination and to increase some valuable understanding
from the huge measures of information, certain devices are utilized. These tools basically fill in
as an information as a platform instrument. The three tools are as follows;
 Weka analytics tool - Weka (Waikato Environment for Knowledge Analysis) is a well
known suite of AI programming written in Java, created at the University of Waikato,
New Zealand. Weka is free programming accessible under the GNU General Public
License. Weka is an accumulation of AI calculations for taking care of certifiable
information mining issues. It is composed in Java and keeps running on practically any
stage. The calculations can either be applied legitimately to a dataset or called from your
own Java code [5].
 Zoho Analytics - Concentrating on convenience an especially key characteristic as
information instruments develop. Zoho analytics is a self administration alternative.
Implying that clients won't require its help staff or expert information researchers to
gather understanding from information. Remarkably, the Zoho analytics software has a
simplified interface, just as a great spreadsheet-style interface[1].
 Microsoft Power BI - Power BI is a decent choice for associations searching for a
simple entrance ramp into Big Data Analytics and is an especially clear decision for those

3
that have effectively institutionalized on a Microsoft stack. Power BI gives cloud based
business examination and coordinates what Microsoft calls "content packs" with pre-
constructed dashboards and report for various kinds of investigation and information
checking. The joint effort abilities in the stage empowers clients to share information and
dashboard, while giving cautioning capacities[2].
Data analytics techniques
 Decision tree – Decision tree takes the structure of tree up different nodes such as
testing, starting, ending and branches nodes[3].
 Back propation algorithm – Back propation algorithm involves training of a dataset
based on the neural network. There are two types of signals which flows on opposite
directions; that is fictional and error signals[4].
 Quantitative analysis – It evaluates patterns and correlations in a dataset.
Utilizing measurable strategies, analysis depends on huge cross areas. Huge example size
characterizes speculation of got results to whole dataset. Results are numerical and in this
manner could be utilized for further numerical correlations and tasks to uncover and
measure connections.
 Qualitative analysis – It depends on human word portrayal of information patterns and
relations. Dissected information test is littler contrasted with the volume of information
examined with quantitative analysis and here the objective is to delve further in the
information semantics. In light of moderately little example size, the analysis can't sum
up ends to generally speaking dataset. The outcomes are not numerical but rather

4
enlightening and can't deliver numerical dataset. The yield of Qualitative investigation is
a portrayal of the interdependencies communicated in words[6].
 Clustering (unsupervised AI) – It is an unaided learning strategy by which information
order (division) is taken care of into various gatherings dependent on likeness of
information properties as a division foundation. There is no requirement for past learning
of classes. Classes are framed implicitly as an outcome of information gathering rather
than this. Information arrangement calculation uses frames in a manner by which
information is assembled or separate calculations utilize distinctive group recognizable
proof strategies[7].
Demonstration
 Datasets
We are going to use the datasets from the UCI repository. It is a bank dataset with 11 attributes
and 600 data items. The link for the dataset is provided in the instruction file.
 Results
Here are the results of analyzing the bank dataset in Weka software. We are going to
compare two techniques that is decision tree and back propation algorithm. MLP is back
propation and j48 will be decision tree algorithm[8].

5
The snippet below illustrate the chart for the accuracy of the bank dataset

6

7
Here is the snippet for evaluation parameters on vote data set
The snippet below is for comparative accuracy for the whole data set that is bank and vote
datasets.

8
We have classified the UCI dataset with two techniques that is decision tree and ack propation
algorithm using Weka analytics tool. Performance of the two techniques is based on the accuracy
like TP and FP[9].
Section 2
Pcap files are captured in router 1 in the figure shown below. The purpose of the configuration
below is to capture the normal and abnormal traffic in the network. We configured the setup with
IXIA tool. This tool is used to generate both the normal and the attack traffic in the network.

9
Traffic analysis
The table shown below illustrate the period of simulation and different bytes in the network. It
also indicate both the normal and the abnormal traffic in the network.

10

11

12
Architectural Framework
The table shown below elaborates on all the features of the CSV files.

13
We generated the pcap files via the tcpdump tool. The Bro IDS tools are used to get the features
of the dataset. In Bro IDS, there are 12 algorithms which are coded in C hash programming
language[10].
Bro files features
We generated the features of the bro files using the Argus tool. Bro IDS tool is used for
analyzing the traffic and the suspicious activities over the network. Bro files generated;
 Conn file
 Http file
 Ftp file

14
Basic features of the dataset from Wireshark

15

16
Section 3
3.1 Data Formats
Comma Separated Values (CSV)
In moderately short measure of time information can be swapped and changed utilizing a few
spreadsheet devices, in Comma Isolated qualities Format. Every single record is in one line
commas separate fields from one another and conspicuous and sporadic whitespaces are
overlooked. It is generally utilized Format in Hadoop stage[11].

17
Cap file format
To make .CAP records, you need to utilize Wireshark or some other programming from the
rundown underneath. Projects for Linux, Mac, and Windows can be downloaded from authority
stores. .Top record creator download is likewise accessible on the product authority source. To
become familiar with .CAP record opener and its options, visit the program authority site. To
dispatch .CAP document on your foundation, use .CAP record launcher or another delicate
recorded beneath. When you download and introduce the .CAP record peruser, you will have the
option to open all .CAP reports. Documents with the .CAP expansion contain information caught
by information transmission pack following projects. The information is in crude structure,
which means the very same structure it was caught in[12].
Bro file format
Documents which are given the .BRO augmentation are known as Tree Professional Broadleaf
Creator records, anyway other record types may likewise utilize this expansion. In the event that
you know about any extra document arranges that utilization the BRO expansion, if you don't
mind let us know. The most ideal approach to open a BRO document is to just double tap it and
let the default assoisated application open the record. On the off chance that you can't open the
record along these lines, it might be on the grounds that you don't have the right application
related with the expansion to see or alter the BRO document[11].
Features with rationale

18
Training and testing data samples
There are two data samples;
It is a bank dataset with 11 attributes and 600 data items. The link for the dataset is provided in
the instruction file.
 Bank dataset
 Vote dataset

19
Data analytic techniques for testing
It is conceivable to test huge information applications that depend on examination, however
analyzers' desires must change. To begin with, analyzers should take a gander at an accumulation
of information as an asset to decide measurable outcomes, as opposed to only something to
question. This implies analyzers need to utilize something other than an inspecting of enormous
information[10].
Last, you should not assess test results by their rightness, as there is no simple method to
establish that. You may need to break the issue into littler pieces and investigate tests from each
piece. Utilize specialized aptitudes and critical thinking inventiveness to decide how to decipher
test outcomes. For instance, when you test enormous information gathered from online life, you
may need to look at each different web based life channel to ensure showed notices relate to

20
client purchasing conduct.
Performance of intrusion detection
Confusion matrix
Confusion matrix depicts the results after classification of datasets. They can be true or false as
illustrated by the figure below;
TP – True Positive
FP – False positive
TN – True Negative
FN – False Negative
Disregarding the authentic intensity of the perplexity lattice in characterization, it's anything but
a very valuable device for examination of the IDSs. To tackle this issue, diverse execution
measurements are characterized as far as the perplexity framework factors. These measurements
produce so me numeric values that are effectively practically identical and are quickly clarified
in resulting passages[12].

21
Limitation of overfitting
 Give less data on the connection between the indicators and the reaction.
 One-sided toward indicators with more difference or levels.
 Can have issues with profoundly collinear indicators.
 Can have poor expectation precision for reactions with low example sizes.

22
Recommendation and future work
Customary IDS experience the ill effects of various issues that point of confinement their
adequacy and proficiency. In differentiate DM and NBA are promising methodologies for
interruption location. In this paper, we examined DM and NBA approaches for system
interruption location. We proposed that a mix of the two methodologies may conquer the
restrictions in current IDS and prompts high execution ones. NBA can help spread the hole in
customary system frameworks, which considers a decent move for the majority of enterprises to
coordinate NBA with cutting edge DM to accomplish a superior execution. NBA can
fundamentally upgrade the estimation of the information produced from IDS that utilization DM
as interruption identification system by dissecting and corresponding enormous measure of
arrangement information. We intend to put the recommended half breed framework model by
and by and apply it on genuine world interruption location issues.
Reference
[1] J. Han and M. Kamber, “Data Mining: Concepts and Techniques”, Morgan Kaufmann, 2nd ,
2006

23
[2] Z. Haiyang, "A Short Introduction to Data Mining and Its Applications", IEEE, 2011
[3] Kritika Yadav and Mahesh Parmar: Analysis of Mahatma Gandhi National Rural
Employment
Guarantee Act Using Data Mining Technique. International Journal of Computational
Intelligence
Research (IJCIR). 2017, Volume 13, Number 9 (2017), pp. 2221-2235, ISSN 0973-1873
[4] Kritika Yadav, Mahesh Parmar: Review Paper on Data Mining and its Techniques and
Mahatma
Gandhi National Rural Employment Guarantee Act. International Journal of Computer Science
and
Engineering (JCSE), April 2017, Volume-5, Issue-4, pp. 68-73, E-ISDN: 2347-2693.
[5] Moksha Shridhar, Mahesh Parmar: Survey on Association Rule Mining and Its Application.
International Journal of Computer Science and Engineering (JCSE), March 2017, Volume-5,
Issue-3,
pp. 129-135, E-ISDN: 2347-2693.
[6] Saichanma, Sarawut, Sucha Chulsomlee, Nonthaya Thangrua, Pornsuri Pongsuchart, and
Duangmanee
Sanmun. "The Observation Report of Red Blood Cell Morphology in Thailand Teenager by
Using Data
Mining Technique." Advances in hematology 2014.
[7] Y. Freund and L. Mason. The alternating decision tree algorithm. In Proceedings of the 16th
International Conference on Machine Learning, pages 124-133, 1999
[8] Sumit Garg , AK. Sharma, “Comparative Analysis of Data Mining Techniques on

24
Educational
Dataset”, International Journal of Computer Applications, Vol.74, No.5, pp.1-7, 2013.
[9] Bhavesh Patankar, Vijay Chavda, “A Comparative Study of Decision Tree, Naïve Bayesian
and k-nn
Classifiers in Data Mining”, International Journal of Advanced Research in Computer Science
and
Software Engineering, Vol.4, Issue.12, pp.24-31, 2014.
[10] kumar Y, Sahoo G. Analysis of Bayes, Neural Network and Tree Classifier of Classification
Technique
in Data Mining using WEKA Computer Science and Information Technology (CS & IT)-CSCP.
2012.
[11] David, Satish Kumar, Amr TM Saeb, and Khalid Al Rubeaan. "Comparative Analysis of
Data Mining
Tools and Classification Techniques using WEKA in Medical Bioinformatics." Computer
Engineering
and Intelligent Systems 4, no. 13 (2013): 28-38.
[12] Anshul Goyal, Rajni Mehta, “Performance Comparison of Naive Bayes and J48
Classification
Algorithms”, IJAER, Vol. 7, No. 11, 2012, pp.