| --- |
| license: mit |
| --- |
| Model Name |
| CyberAttackClassifier V1 – A Random Forest-based model for classifying cybersecurity attacks using network and system log data. |
|
|
| 📖 Overview |
| CyberAttackClassifier V1 is a supervised machine learning model trained to classify various types of cybersecurity attacks based on structured log and alert data. It uses a Random Forest Classifier trained on a feature-selected dataset, achieving near-perfect performance across multiple evaluation metrics. |
|
|
| 🔍 Intended Uses |
| Threat Detection: Automatically classify incoming events or logs into known attack categories. |
|
|
| Security Monitoring: Enhance SIEM systems with predictive capabilities. |
|
|
| Feature Analysis: Identify key indicators and patterns associated with different attack types. |
|
|
| Incident Response Prioritization: Quickly assess and categorize threats for faster triage. |
|
|
| 🧠 Model Architecture |
| Attribute Value |
| Model Type Random Forest Classifier |
| Framework scikit-learn |
| Input Shape (raw) (100000, 197) |
| Input Shape (selected) (100000, 50) |
| Feature Selection SelectKBest (f_classif) |
| Categorical Imputation 'Unknown' for missing values |
| Encoding One-hot for categorical features |
| Scaling StandardScaler for numerical features |
| 📚 Training Details |
| Dataset Size: 100,000 samples |
| |
| Missing Values: Imputed in object-type columns |
| |
| Feature Selection: Top 50 features selected using ANOVA F-test |
| |
| Train/Test Split: Standard split (e.g., 80/20 or stratified) |
| |
| 📈 Evaluation Metrics |
| Metric Value |
| Accuracy 0.9980 |
| Precision ~0.9980 |
| Recall ~0.9980 |
| F1-score ~0.9980 |
| ✅ Note: These metrics indicate strong performance across all attack types, with minimal misclassifications. |
| |
| 📊 Confusion Matrix & Classification Report |
| Confusion Matrix: Dominant diagonal, indicating high true positive rates |
| |
| Classification Report: High precision, recall, and F1-scores for most attack classes |
| |
| 🔍 Feature Importance |
| Top features identified using Random Forest’s feature_importances_ attribute |
|
|
| Further analysis of top 10–15 features recommended to understand key attack indicators |
|
|
| Feature names available via mapping from SelectKBest output |
|
|
| 🚀 How to Use |
| python |
| from cyberattackclassifier import AttackModel |
|
|
| model = AttackModel.load_pretrained("your-huggingface-username/cyberattackclassifier-v1") |
| input_data = { |
| "Firewall Logs": "Unknown", |
| "Proxy Information": "Blocked", |
| "IDS/IPS Alerts": "High", |
| ... |
| } |
| prediction = model.predict(input_data) |
| ⚠️ Limitations |
| Imbalanced Data Risk: Ensure attack types are well-represented in training data |
| |
| Feature Drift: Model may degrade if log formats or attack patterns evolve |
|
|
| Interpretability: Random Forests are less interpretable than linear models; use feature importance tools |
|
|
| 📄 License |
| Apache 2.0 or MIT License (choose based on your preference) |
|
|
| 👤 Author |
| Created by [Your Name or Organization] |
|
|
| 📚 Recommendations for Open-Sourcing |
| Include preprocessing pipeline (imputation, encoding, scaling) |
|
|
| Provide training and evaluation scripts |
|
|
| Share feature importance analysis and mapping |
|
|
| Document attack type taxonomy used in classification |
