unsw-nb15-intrusion-detection/analysis.R at main · krishsharma5169/unsw-nb15-intrusion-detection · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# ================================================================
# Group X - Cyber Intrusion Detection Coursework
# Members:
# Krish, TPXXXXXX
# Member2, TPXXXXXX
# Member3, TPXXXXXX
# Member4, TPXXXXXX
# ================================================================

# ================================================================
# Objective 1: To investigate the relationship between sload & dload
#              towards the presence of attack (label)
# Student: Krish, TPXXXXXX
# ================================================================

# --- Analysis 1-1: Data Import and Exploration ---
# What I want to discover: Inspect dataset structure and identify missing values
data <- read.csv("C:\\Users\\deads\\OneDrive\\Desktop\\APU studies\\SEM 3 (Year 2)\\Programming for Data Analysis\\R project\\UNSW-NB15_uncleaned.csv")

# Ensure key variables are numeric (important for quantile, correlation, etc.)
data$sload <- as.numeric(gsub(",", "", data$sload))
data$dload <- as.numeric(gsub(",", "", data$dload))
data$label <- as.numeric(gsub(",", "", data$label))

# Explore dataset
str(data)
summary(data[, c("sload", "dload", "label")])
head(data, 10)


# --- Analysis 1-2: Missing Value Detection and Imputation ---
# What I want to discover: Handle missing values without removing rows

# Check missing counts
sum(is.na(data$sload))
sum(is.na(data$dload))

# Median Imputation for numeric variables
median_impute <- function(x) {
  x[is.na(x)] <- median(x, na.rm = TRUE)
  return(x)
}

data$sload <- median_impute(data$sload)
data$dload <- median_impute(data$dload)

# Mode function for categorical (if needed)
getmode <- function(v) {
  uniqv <- unique(v)
  uniqv[which.max(tabulate(match(v, uniqv)))]
}

# Example: if label had missing values, fill with mode
# data$label[is.na(data$label)] <- getmode(data$label)

# Confirm no missing values remain
sum(is.na(data$sload))
sum(is.na(data$dload))


# --- Analysis 1-3: Hot Deck Imputation (Alternative) ---
# What I want to discover: Compare with another valid imputation method
library(VIM)
data_hd <- hotdeck(data, variable = c("sload", "dload"))
sum(is.na(data_hd$sload))
sum(is.na(data_hd$dload))


# --- Analysis 1-4: Outlier Treatment ---
# What I want to discover: Cap extreme outliers using 99th percentile

cap_sload <- quantile(data$sload, 0.99, na.rm = TRUE)
data$sload[data$sload > cap_sload] <- cap_sload

cap_dload <- quantile(data$dload, 0.99, na.rm = TRUE)
data$dload[data$dload > cap_dload] <- cap_dload


# --- Analysis 1-5: Descriptive Statistics ---
# What I want to discover: Summarize cleaned numeric variables
summary(data[, c("sload", "dload")])


# --- Analysis 1-6: Visualization ---
# What I want to discover: Distribution differences between attack (1) and normal (0)

library(ggplot2)

# Histogram
ggplot(data, aes(x = sload, fill = factor(label))) +
  geom_histogram(bins = 50, alpha = 0.7, position = "identity") +
  labs(title = "Histogram of Source Load (sload)", fill = "Label")

# Boxplot
ggplot(data, aes(x = factor(label), y = sload, fill = factor(label))) +
  geom_boxplot() +
  labs(title = "Boxplot of Source Load by Label", x = "Traffic Type", y = "sload")


# --- Analysis 1-7: Correlation Analysis ---
# What I want to discover: Relationship between sload, dload, and attack label
cor_matrix <- cor(data[, c("sload", "dload", "label")], use = "complete.obs")
print(cor_matrix)


# ================================================================
# Extra Feature 1: Correlation Heatmap
# Student: Krish, TPXXXXXX
# ================================================================
# Comment: A heatmap provides a clearer visual representation
# of the correlation between sload, dload, and label.

library(corrplot)
corrplot(cor_matrix, method = "color", addCoef.col = "black",
         tl.col = "black", tl.srt = 45)


# ================================================================
# Extra Feature 2: Logistic Regression
# Student: Krish, TPXXXXXX
# ================================================================
# Comment: Logistic regression was applied to evaluate whether
# sload and dload can significantly predict the presence of attack.

log_model <- glm(label ~ sload + dload, data = data, family = binomial)
summary(log_model)

# Odds Ratios
exp(coef(log_model))


# ================================================================
# Extra Feature 3: Scatter Plot of sload vs dload
# Student: Krish, TPXXXXXX
# ================================================================
# Comment: A scatter plot helps visualize separation between normal
# and attack traffic based on network load features.

ggplot(data, aes(x = sload, y = dload, color = factor(label))) +
  geom_point(alpha = 0.5) +
  labs(title = "Scatter Plot of sload vs dload", color = "Label")