1
$\begingroup$

How to detect patterns in a data set of given IP addresses using a neural network?

The data set is actually a list of all the vulnerable devices on a network. I want to use a neural network that detctes any patters in the occurrences of these vulnerabilities with reference to their IPs and ports.

Improve this question
$\endgroup$
2
  • $\begingroup$ is your dataset purely (ip, vulenerable) pairs or is there more, like a temporal aspect, etc $\endgroup$
    – mshlis
    Jul 31, 2019 at 13:28
  • $\begingroup$ @mshlis the data set is purely (ip, vulnerable) pairs. $\endgroup$
    – Uzair Ahmed
    Aug 16, 2019 at 4:48

1 Answer 1

Reset to default
1
$\begingroup$

It seems that you want to detect ranges of IP addresses that are vulnerable/dangerous/etc, right? Such ranges are essentially numeric intervals, and so my suggestion is to look at decision tree learning instead of neural networks, because you are essentially doing a classification task where you want to test both categorical data and splits over numerical attributes.

The result will be a tree-like function (nested conditionals) of the form

IF ...> address > ... 
   THEN [vulnerable]
   ELSE IF port=... 
              THEN [not vulnerable]
              ELSE [vulnerable]

where a huge benefit is that it is also more human-readable than a neural net.

The most prominent algorithms for decision trees are ID 3 and its successor C4.5.

Improve this answer
$\endgroup$
7
  • $\begingroup$ I have the data sets of couputers that is purely of the type (ip, vulnerability). I know which devices are vulnerable. I just want to detect a pattern to the occurrence of these vulnerable computers. $\endgroup$
    – Uzair Ahmed
    Aug 16, 2019 at 4:52
  • $\begingroup$ Could you please state more specifically what you mean by a "pattern"? What would be the desired outcome of the learning process? Could you perhaps give a small example? $\endgroup$
    – Jens Classen
    Aug 16, 2019 at 17:53
  • $\begingroup$ After the learning process, I want it to give a general rule as to where in an network do the vulnerabilities occur with reference to thier IPs. $\endgroup$
    – Uzair Ahmed
    Aug 17, 2019 at 18:04
  • $\begingroup$ So the goal is to learn a mapping {IP addresses} -> {vulnerabilities}. Learning always involves some form of generalization or abstraction. In which direction should this happen? Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X" or the other way round, i.e. "addresses that have vulnerabilities X and Y often also have Z"? $\endgroup$
    – Jens Classen
    Aug 19, 2019 at 18:40
  • $\begingroup$ the first type i.e. Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X. $\endgroup$
    – Uzair Ahmed
    Aug 21, 2019 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .