How to detect patterns in a data set of given IP addresses using a neural network?

The data set is actually a list of all the vulnerable devices on a network. I want to use a neural network that detctes any patters in the occurrences of these vulnerabilities with reference to their IPs and ports.

  • $\begingroup$ is your dataset purely (ip, vulenerable) pairs or is there more, like a temporal aspect, etc $\endgroup$ – mshlis Jul 31 '19 at 13:28
  • $\begingroup$ @mshlis the data set is purely (ip, vulnerable) pairs. $\endgroup$ – Uzair Ahmed Aug 16 '19 at 4:48

It seems that you want to detect ranges of IP addresses that are vulnerable/dangerous/etc, right? Such ranges are essentially numeric intervals, and so my suggestion is to look at decision tree learning instead of neural networks, because you are essentially doing a classification task where you want to test both categorical data and splits over numerical attributes.

The result will be a tree-like function (nested conditionals) of the form

IF ...> address > ... 
   THEN [vulnerable]
   ELSE IF port=... 
              THEN [not vulnerable]
              ELSE [vulnerable]

where a huge benefit is that it is also more human-readable than a neural net.

The most prominent algorithms for decision trees are ID 3 and its successor C4.5.

| improve this answer | |
  • $\begingroup$ I have the data sets of couputers that is purely of the type (ip, vulnerability). I know which devices are vulnerable. I just want to detect a pattern to the occurrence of these vulnerable computers. $\endgroup$ – Uzair Ahmed Aug 16 '19 at 4:52
  • $\begingroup$ Could you please state more specifically what you mean by a "pattern"? What would be the desired outcome of the learning process? Could you perhaps give a small example? $\endgroup$ – Jens Classen Aug 16 '19 at 17:53
  • $\begingroup$ After the learning process, I want it to give a general rule as to where in an network do the vulnerabilities occur with reference to thier IPs. $\endgroup$ – Uzair Ahmed Aug 17 '19 at 18:04
  • $\begingroup$ So the goal is to learn a mapping {IP addresses} -> {vulnerabilities}. Learning always involves some form of generalization or abstraction. In which direction should this happen? Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X" or the other way round, i.e. "addresses that have vulnerabilities X and Y often also have Z"? $\endgroup$ – Jens Classen Aug 19 '19 at 18:40
  • $\begingroup$ the first type i.e. Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X. $\endgroup$ – Uzair Ahmed Aug 21 '19 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.