# How to detect patterns in a data set of given IP addresses using a neural network?

How to detect patterns in a data set of given IP addresses using a neural network?

The data set is actually a list of all the vulnerable devices on a network. I want to use a neural network that detctes any patters in the occurrences of these vulnerabilities with reference to their IPs and ports.

• is your dataset purely (ip, vulenerable) pairs or is there more, like a temporal aspect, etc Jul 31 '19 at 13:28
• @mshlis the data set is purely (ip, vulnerable) pairs. Aug 16 '19 at 4:48

It seems that you want to detect ranges of IP addresses that are vulnerable/dangerous/etc, right? Such ranges are essentially numeric intervals, and so my suggestion is to look at decision tree learning instead of neural networks, because you are essentially doing a classification task where you want to test both categorical data and splits over numerical attributes.

The result will be a tree-like function (nested conditionals) of the form

IF ...> address > ...
THEN [vulnerable]
ELSE IF port=...
THEN [not vulnerable]
ELSE [vulnerable]


where a huge benefit is that it is also more human-readable than a neural net.

The most prominent algorithms for decision trees are ID 3 and its successor C4.5.

• I have the data sets of couputers that is purely of the type (ip, vulnerability). I know which devices are vulnerable. I just want to detect a pattern to the occurrence of these vulnerable computers. Aug 16 '19 at 4:52
• Could you please state more specifically what you mean by a "pattern"? What would be the desired outcome of the learning process? Could you perhaps give a small example? Aug 16 '19 at 17:53
• After the learning process, I want it to give a general rule as to where in an network do the vulnerabilities occur with reference to thier IPs. Aug 17 '19 at 18:04
• So the goal is to learn a mapping {IP addresses} -> {vulnerabilities}. Learning always involves some form of generalization or abstraction. In which direction should this happen? Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X" or the other way round, i.e. "addresses that have vulnerabilities X and Y often also have Z"? Aug 19 '19 at 18:40
• the first type i.e. Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X. Aug 21 '19 at 17:38