Na-Rajan/CyberAttackClassifier

Model Name CyberAttackClassifier V1 – A Random Forest-based model for classifying cybersecurity attacks using network and system log data.

📖 Overview CyberAttackClassifier V1 is a supervised machine learning model trained to classify various types of cybersecurity attacks based on structured log and alert data. It uses a Random Forest Classifier trained on a feature-selected dataset, achieving near-perfect performance across multiple evaluation metrics.

🔍 Intended Uses Threat Detection: Automatically classify incoming events or logs into known attack categories.

Security Monitoring: Enhance SIEM systems with predictive capabilities.

Feature Analysis: Identify key indicators and patterns associated with different attack types.

Incident Response Prioritization: Quickly assess and categorize threats for faster triage.

🧠 Model Architecture Attribute Value Model Type Random Forest Classifier Framework scikit-learn Input Shape (raw) (100000, 197) Input Shape (selected) (100000, 50) Feature Selection SelectKBest (f_classif) Categorical Imputation 'Unknown' for missing values Encoding One-hot for categorical features Scaling StandardScaler for numerical features 📚 Training Details Dataset Size: 100,000 samples

Missing Values: Imputed in object-type columns

Feature Selection: Top 50 features selected using ANOVA F-test

Train/Test Split: Standard split (e.g., 80/20 or stratified)

📈 Evaluation Metrics Metric Value Accuracy 0.9980 Precision ~0.9980 Recall ~0.9980 F1-score ~0.9980 ✅ Note: These metrics indicate strong performance across all attack types, with minimal misclassifications.

📊 Confusion Matrix & Classification Report Confusion Matrix: Dominant diagonal, indicating high true positive rates

Classification Report: High precision, recall, and F1-scores for most attack classes

🔍 Feature Importance Top features identified using Random Forest’s featureimportances attribute

Further analysis of top 10–15 features recommended to understand key attack indicators

Feature names available via mapping from SelectKBest output

🚀 How to Use python from cyberattackclassifier import AttackModel

model = AttackModel.loadpretrained("your-huggingface-username/cyberattackclassifier-v1") inputdata = { "Firewall Logs": "Unknown", "Proxy Information": "Blocked", "IDS/IPS Alerts": "High", ... } prediction = model.predict(input_data) ⚠️ Limitations Imbalanced Data Risk: Ensure attack types are well-represented in training data

Feature Drift: Model may degrade if log formats or attack patterns evolve

Interpretability: Random Forests are less interpretable than linear models; use feature importance tools

📄 License Apache 2.0 or MIT License (choose based on your preference)

👤 Author Created by [Your Name or Organization]

📚 Recommendations for Open-Sourcing Include preprocessing pipeline (imputation, encoding, scaling)

Provide training and evaluation scripts

Share feature importance analysis and mapping

Document attack type taxonomy used in classification