Download as doc, pdf, or txt
Download as doc, pdf, or txt
You are on page 1of 46

NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 1

INTRODUCTION

With the advancement in the technology, millions of people are now connected with each
other through one or other form of network where they share lots of important data.
Hence the need of security to safeguard data integrity and confidentiality is increased
rapidly. Although effort have been made to secure data transmission but at the same time,
attack technique for breaching the network continued to evolve. Intrusion detection
system (IDS) is software and/or hardware designed to detect unwanted attempts at
accessing, manipulating, and/or disabling of computer systems, mainly through a
network, such as the Internet. Firewalls limits access between networks to prevent
intrusion and do not signal an attack from inside the network.

An IDS evalu- ates a suspected intrusion once it has taken place and signals an
alarm. As the network of computers expands both in number of hosts connected and
number of services provided, security has become a key issue for the technology
developers. This work presents a pro- totype of an intrusion detection system for
networks. There is often the need to update an installed Intrusion Detection System (IDS)
due to new attack methods or upgraded computing environments. Since many current
IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are
expensive and slow.

To detect intrusions the process of learning the behavior of a given program by


using machine-learning techniques. Thus it leads to the need of such a system which can
adapt with this ever changing attack techniques. In this paper, we have purposed a system
which is based on machine learning. Our aim is to find the based suitable machine
learning algorithm which can predict the type of network attack with highest accuracy
and then develop a system which uses this algorithm to detect network intrusion.

The dataset used for training the model is KDD 99 dataset. The reason why we
have used machine learning is the flexibility that it provides to the system for example, if
any new type of attack is developed in future the system can be trained for predicting that
attack. There are a few types of intrusion detection system out of which ours is a
knowledge based intrusion detection system which is also known as the anomaly based

Dept of CSE, Karavali Institute of Technology Page 1


NETWORK INTRUSION DETECTION SYSTEM 2019

system. It registers the anomalies and in future predicts such malicious network to send
out an alert. This way the network can disconnect to the such a connection and then have
only secured connections.

1.1 Purpose

The purpose of the system being built is to provide a solution for the Users to
protect their systems. Hence they can make a better understanding of the attacks and get
alerts on attacks.

1.2 Motivation

The motivation of this work is to tackle the issues of helping online shopping sites
and their users to protect their systems by monitoring and understanding about attacks.

1.3 Problem description

We are proposing the Real Time Intrusion Detection System using ML algorithm
which mainly implies the detection of abnormal packets using past experience of the
system. Here the incoming packets are analysed and categorized according to values of
the attributes to produce dataset.
Using this data set the next arriving packets are detected as normal or abnormal
packets. If abnormal packets are detected reporting can be done.
.

Report Architecture

The rest of the report is organized as follows,

Chapter 2: Literature Survey gives details about the survey conducted before starting the
project.

Chapter 3: Methodology gives details about the approach in which the problem is being
solved

Chapter 4: System Analysis gives details about the existing system and proposed system.

Dept of CSE, Karavali Institute of Technology Page 2


NETWORK INTRUSION DETECTION SYSTEM 2019

Chapter 5: System Requirement Specification gives details about the collection of


information such as software and hardware that embodies the requirements of a system.

Chapter 6: System Design describes the architecture, modules and data flow diagrams.

Chapter 7: This chapter discusses the System Implementation.

Chapter 8: System Testing discusses the test cases involved in testing the system.

Chapter 9: Results

Conclusion and Future Work

Reference includes details of all books, papers and websites referred during project
development.

Dept of CSE, Karavali Institute of Technology Page 3


NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 2

LITERATURE SURVEY

In [1], Rafath and D Vasumathi, classified the intrusion detection system into two
types namely Network based IDS and Host IDS. The latter monitors all the activities of
inspected packets and resources that are being utilized by the programs. In case of any
alteration in networks, the user gets a network alert. HIDS is incorporated into the
computer framework to detect the abnormalities and protect the information from the
intruder. On the other hand, NIDS is the attribute function of target system. It uses anti-
thread software to control incoming and outgoing threads. It consists of signature-based
classification, which help in identifying the abnormalities by comparing it with log files
and previous signature.

In [2], the authors proposed an AI based Intrusion detection system using a deep
neural network. Neural networks consisting of four hidden layers and 100 hidden units
was used for the intrusion detection system. They used non-linear ReLU as the activation
function for the hidden layer neurons to enhance the model’s performance. They adopt
stochastic optimization method for learning in DNN. For the training and testing of their
model they used KDD CUP 99 dataset. They were able to reach the accuracy of 99% for
all the cases.

In [3], they have proposed a NIDS (Network Intrusion Detection System) which is
based on a feature selection method called Recursive Feature Addition (RFA) and bigram
technique. They tested the model on the ISCX 2012 data set. Moreover, they have
proposed a bigram technique to encode payload string features into a useful
representation that can be used in feature selection. They have also proposed a new
evaluation metric called that combines accuracy, detection rate and false alarm rate in a
way that helps in comparing different systems and selecting the best among them.

In [4], they have proposed a new intrusion detection system and addressed the
problem of adaptability in the field of intrusion detection. The proposed IDS is an
adaptive solution which provides the capability of detecting known and novel attacks as
well as being updated according to the new input from human experts in a cost-effective
manner.

[5], it deals with the evaluation and statistical analysis of labelled flow based
CIDDS-001 dataset used for evaluating Anomaly based (NIDS) Network Intrusion
Detection Systems. They basically used two techniques, k-means clustering and k-nearest
neighbor classification to measure the complexity in terms of prominent metrics. Based
on evaluation, they concluded that both k-means clustering k-nearest neighbor
classification perform well over CIDDS-001 dataset in terms of used prominent metrics.
Hence the dataset can be used for the evaluation of Anomaly based Network Intrusion
Detection Systems.

Dept of CSE, Karavali Institute of Technology Page 4


NETWORK INTRUSION DETECTION SYSTEM 2019

In [6], The IDS is based on anomaly detection method. In such technique, a


system tries to estimate the ‘normal’ state of the network and generates an alert when any
activities deviate from this ‘normal’ state. The main benefit of anomaly-based system is
that it is able to detect previously unseen intrusion events. They have classified detection
techniques into three categories statistical based, knowledge-based, and machine
learning-based. In statistical based technique, a random viewpoint is used to represent the
behavior of the system. While knowledge based technique, utilize the available system
data to capture the behavior of system. Finally, the machine learning based technique uses
an explicit or implicit model to enable categorization of the analyzed pattern.

Dept of CSE, Karavali Institute of Technology Page 5


NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 3

SYSTEM REQUIREMENT ANALYSIS

A System Requirements Analysis in the field of system engineering and software


engineering that encompasses those tasks that are needs or conditions to meet for a new
or altered product or project. It is a complete description of the requirements for the
system to be developed.

3.1 Feasibility Study:

The feasibility study is an evaluation and analysis of the potential of a proposed


project. It is based on extensive investigation and research to support the process of
decision making. Feasibility studies aim to objectively and rationally uncover the
strengths and weaknesses of an existing business or proposed venture, opportunities and
threats present in the environment, the resources required to carry through, and ultimately
the prospects for success. In its simplest terms, the two criteria to judge feasibility
are cost required and value to be attained.

A well-designed feasibility study should provide a historical background of the


business or project, a description of the product or service, accounting statements, details
of the operations and management, marketing research and policies, financial data, legal
requirements and tax obligations. Generally, feasibility studies precede technical
development and project implementation.

3.1.1 Operational Feasibility:


Operational feasibility is a measure of how well a proposed system solves the
problems, and takes advantage of the opportunities identified during scope definition and
how it satisfies the requirements identified in the requirements analysis phase of system
development.

3.1.2 Economical Feasibility:


The economic feasibility study is to evaluate the cost of the software development
against the ultimate income or benefits gets from the developed system. There must be
scopes for profit after the successful Completion of the project.

Dept of CSE, Karavali Institute of Technology Page 6


NETWORK INTRUSION DETECTION SYSTEM 2019

3.1.3 Technical Feasibility


Technical feasibility assesses the current resources (such as hardware and
software) and technology, which are required to accomplish user requirements in the
software within the allocated time and budget. For this, the software development team
ascertains whether the current resources and technology can be upgraded or added in the
software to accomplish specified user requirements.

Dept of CSE, Karavali Institute of Technology Page 7


NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 4

SYSTEM REQUIREMENTS SPECIFICATION

4.1 Overall Description


The system is more reliable, flexible, scalable and secure and easy to use than the
present system. In the proposed system all the parameter are considered to maintain neat
and easier solutions.

4.2 Functional Requirements


The basic services that the System include,
1. Entry of New product and data to the Database
2. Update the details to modify.
3. The system shall provide for password protected administrator access to add,
delete & modify the basic services offered by the system.
4. User Interface & Security: A flexible and easy to use user interface in provided
which guarantees the required security as it is operated online.

4.3 Software Requirement


 Operating System : Windows XP or above
 Web Server : XAMPP
 IDE : Netbeans
 Scripting language : PHP,Javascript,R
 Database : MySQL

4.4 Hardware Requirements


 Processor : Pentium
 Speed : 1.1 GHz
 RAM : 2GB
 Hard Disk : 20 GB
 Key Board : Standard Windows Keyboard
 Mouse : Two or Three Button Mouse

Dept of CSE, Karavali Institute of Technology Page 8


NETWORK INTRUSION DETECTION SYSTEM 2019

4.5 Developing Tool

PHP Development Tools (PDT) is a language IDE plugin for the Eclipse


platform and the open source project that develops it. The project intends to encompass
all tools necessary to develop PHP based software. It uses the existing Eclipse Web Tools
Project to provide developers with PHP capabilities.

4.5.1 Web Server:

XAMPP is a free & open source cross-platform web server solution


stack package, consisting mainly of the Apache HTTP Server, MySQL database,
and interpreters for scripts written in the PHP programming languages. XAMPP requires
only one zip, tar, 7z, or exe file to be downloaded and run, and little or no configuration
of the various components that make up the web server is required.

Self-contained, multiple instances of XAMPP can exist on a single computer, and


any given instance can be copied from one computer to another. It is offered in both a
full, standard version and a smaller version.

Officially, XAMPP's designers intended it for use only as a development tool, to


allow website designers and programmers to test their work on their own computers
without any access to the Internet. To make this as easy as possible, many important
security features are disabled by default. XAMPP also provides support for creating and
manipulating databases in MySQL.

4.5.2 Scripting Language:

PHP is a server-side scripting language designed for web development but also


used as a general-purpose programming language. PHP originally stood for Personal
Home Page, it now stands for PHP: Hypertext Pre-processor, which is a recursive back
acronym.

PHP code can be simply mixed with HTML code, or it can be used in combination


with various template engines and web frameworks. PHP code is usually processed by a
PHP interpreter, which is usually implemented as a web server's native module or
a Common Gateway Interface (CGI) executable. After the PHP code is interpreted and
executed, the web server sends resulting output to its client, usually in form of a part of

Dept of CSE, Karavali Institute of Technology Page 9


NETWORK INTRUSION DETECTION SYSTEM 2019

the generated web page – for example, PHP code can generate a web page's HTML code,
an image, or some other data. PHP has been widely ported and can be deployed on most
web servers on almost every operating system and platform, free of charge.

4.5.3 Database:
MySQL is the world's second most widely used open-source relational database
management system (RDBMS).It is named after co-founder Michael Widenius's
daughter. The SQL phrase stands for Structured Query Language.
The MySQL development project has made its source code available under the
terms of the GNU General Public License, as well as under a variety of proprietary
agreements. MySQL is owned by Oracle Corporation. And it is a popular choice of
database for use in web applications.

4.5.4 R LANGUAGE
R is a programming language and free software environment for statistical
computing and graphics supported by the R Foundation for Statistical Computing. The R
language is widely used among statisticians and data miners for developing statistical
software and data analysis. Polls, data mining surveys and studies of scholarly literature
databases, show substantial increases in popularity in recent years.
Big data analyst, Scientists, Engineers use R language for Statistical computing,
Graphics and analysis purpose. R is a most popular open source platform with different
version on Windows, Linux and mac OS. R is a comprehensive statistical platform
provides approximate 5000 packages and offers data analytics techniques. It is a powerful
platform for data analysis and exploration. In some cases when size of data is large and it
exceeds from its physical memory, then it performs very slow and gives poor results.

Dept of CSE, Karavali Institute of Technology Page 10


NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 5

SYSTEM DESIGN

System design provides an overview of a solution, system, product, service, or


process with the help of graphical aids or tabular structures. Design is the actual process
of producing a solution according to the specification derived from the analysis stage.
Module description and other diagrams are explained here.

5.1 Modules

1. Admin Module
2. User Module
3. Analysis Module

5.1.1. Admin Module:

The Administrator can manage the whole system. Admin is capable of


managing the data, user request, and the companies. The admin can monitor the requests
and processing of the application.

5.1.2. User Module:

The user can search the product, find the details, analyse the products and get
serviced by the system.

5.1.3. Analysis Module:

In this module, the admin can analyse regarding the attacks and security issues
faced by the system and can get alerted on anomalies.

Dept of CSE, Karavali Institute of Technology Page 11


NETWORK INTRUSION DETECTION SYSTEM 2019

5.2 System Architecture

The components and the relation among the components are shown in figure 1, it
explains the major components and its infrastructure.

There is a common interface between the user and the core components of the
system, this interface provides access to main components.

The working can be briefly explained as, after logging in, the admin add the data
through application to the common interface such that it can be analyzed or processed on
different authority using their platform.

The common interface is developed using the HTML5/CSS components at front


end and MySQL at back end.

Figure 5.1: System Architecture

Dept of CSE, Karavali Institute of Technology Page 12


NETWORK INTRUSION DETECTION SYSTEM 2019

5.2 Use Case Diagram

A use case diagram in the Unified Modelling Language (UML) is a type of


behavioural diagram defined by and created from a Use-case analysis. Its purpose is to
present a graphical overview of the functionality provided by a system in terms of actors.
And their goals and any dependencies between those use cases. The main purpose of a
use case diagram is to show what system functions are performed for which actor.

Register
Admin

Login

Order items
Users
Manage customer data

Request service

View customer orders

Request items

Send mails

Figure 5.2: Use Case Diagram of overall process

Dept of CSE, Karavali Institute of Technology Page 13


NETWORK INTRUSION DETECTION SYSTEM 2019

5.3 Data Flow Diagram


A Data Flow Diagram is a graphical representation of the "flow" of data through
an information system. A data flow diagram can also be used for the visualization of data
processing (structured design). It is common practice for a designer to draw a context
level DFD first which shows the interaction between the system and outside entities.

USERS ONLINE STORE


DATABASE

Figure 5.3: Data Flow Diagram- level 0

LEVEL 1 – ADMIN

ADD ITEM ITEM

EDIT ITEM ITEM

LOGIN
DELETE ITEM
ITEM

ADMIN
LOGIN GET
ALERTS ATTACK

VIEW
STATISTICS ATTACK

MANAGE ORDER
ORDERS

Figure 5.4 DFD admin

Dept of CSE, Karavali Institute of Technology Page 14


NETWORK INTRUSION DETECTION SYSTEM 2019

LEVEL 1 – CUSTOMER

View item ITEM

View
ORDER
orders

LOGIN
Order ORDER
item

USER CANCEL
LOGIN
ORDER ORDER

Update CLOGIN
profile

ALERT
Get alerts

Figure 5.4 DFD customer

Dept of CSE, Karavali Institute of Technology Page 15


NETWORK INTRUSION DETECTION SYSTEM 2019

5.4 Sequence Diagram


A sequence diagram in Unified Modelling Language (UML) is a kind of interaction
diagram that shows how processes operate with one another and in what order and at a
specific time. It is a construct of a Message Sequence Chart. Sequence diagrams are
sometimes called event diagrams, event scenarios, and timing diagrams.

Customer Store :Database

Logged in

Select products

Create order

Modify order

Submit order

Check for clashes

Report Failure

Add to orders

Successfully ordered

Save to Database

Success Success

Figure 5.5 sequence diagram

Dept of CSE, Karavali Institute of Technology Page 16


NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 6

SYSTEM IMPLEMENTATION
System Implementation (SI) is the stage where the theoretical design is converted into a
working system, the new system may be totally new, replacing an existing manual, or
automated system or it may be a major modification to an existing system. The system is
implemented using PHP 7 and MySql.

6.1 Developing Tool

PHP Development Tools (PDT) is a language IDE plugin for the Eclipse


platform and the open source project that develops it. The project intends to encompass
all tools necessary to develop PHP based software. It uses the existing Eclipse Web Tools
Project to provide developers with PHP capabilities.

6.1.1 Web Server:

XAMPP is a free & open source cross-platform web server solution


stack package, consisting mainly of the Apache HTTP Server, MySQL database,
and interpreters for scripts written in the PHP programming languages. XAMPP requires
only one zip, tar, 7z, or exe file to be downloaded and run, and little or no configuration
of the various components that make up the web server is required.

Self-contained, multiple instances of XAMPP can exist on a single computer, and


any given instance can be copied from one computer to another. It is offered in both a
full, standard version and a smaller version.

Officially, XAMPP's designers intended it for use only as a development tool, to


allow website designers and programmers to test their work on their own computers
without any access to the Internet. To make this as easy as possible, many important
security features are disabled by default. XAMPP also provides support for creating and
manipulating databases in MySQL.

Dept of CSE, Karavali Institute of Technology Page 17


NETWORK INTRUSION DETECTION SYSTEM 2019

6.1.2 Scripting Language:

PHP is a server-side scripting language designed for web development but also


used as a general-purpose programming language. PHP originally stood for Personal
Home Page, it now stands for PHP: Hypertext Pre-processor, which is a recursive back
acronym.

PHP code can be simply mixed with HTML code, or it can be used in combination


with various template engines and web frameworks. PHP code is usually processed by a
PHP interpreter, which is usually implemented as a web server's native module or
a Common Gateway Interface (CGI) executable. After the PHP code is interpreted and
executed, the web server sends resulting output to its client, usually in form of a part of
the generated web page – for example, PHP code can generate a web page's HTML code,
an image, or some other data. PHP has been widely ported and can be deployed on most
web servers on almost every operating system and platform, free of charge.

6.1.3 Database:
MySQL is the world's second most widely used open-source relational database
management system (RDBMS).It is named after co-founder Michael Widenius's
daughter. The SQL phrase stands for Structured Query Language.
The MySQL development project has made its source code available under the
terms of the GNU General Public License, as well as under a variety of proprietary
agreements. MySQL is owned by Oracle Corporation. And it is a popular choice of
database for use in web applications.

6.2 METHODOLOGY:

1, Data acquisition process

2, Pool based active learning by training and testing

3, pre-processing the collected reviews

4, Perform feature extraction process

5, Apply supervised learning methods

Dept of CSE, Karavali Institute of Technology Page 18


NETWORK INTRUSION DETECTION SYSTEM 2019

FEATURES
1. Data acquisition

We acquired our dataset of 3 different JSON formats and labeled our dataset. As we have
a large amount or reviews manually labeling was quite impossible for us. Therefor we
preprocessed our data and used Active learner to label the datasets. As amazon reviews
comes in 5-star rating based generally 3 star ratings are considered as neutral reviews
meaning neither positive nor negative. So we discard any review which contains a 3-star
rating from our dataset and take the other reviews and proceed to next step labeling the
dataset.

Pool Based Active Learning:


Active learning is a special case in semi-supervised learning algorithm. The main fact is
that the performance will be better with less training if the learning algorithm is allowed
to choose the data from which it learns . Active learning system tries to solve data
labeling bottleneck by querying for unlabeled instance to be properly labeled by an expert
or oracle. As manually labeling the dataset is quite an impossible task so that to reduce
time complexity we use a special kind of semi-supervised learning approach known as
pull based active

2. Data pre-processing
Tokenization: It is the process of separating a sequence of strings into individuals
such as words, keywords, phrases, symbols and other elements known as tokens. Tokens
can be individual words, phrases or even whole sentences. In the process of tokenization,
some characters like punctuation marks are discarded. The tokens work as the input for
different process like parsing and text mining.
Removing Stop Words: Stop words are those objects in a sentence which are not
necessary in any sector in text mining. So we generally ignore these words to enhance the
accuracy of the analysis. In different format there are different stop words depending on
the country, language etc. In English format there are several stop words.
POS tagging: The process of assigning one of the parts of speech to the given word is
called Parts of Speech tagging. It is generally referred to as POS tagging. Parts of speech
generally contain nouns, verbs, adverbs, adjectives, pronouns, conjunction and their sub-
categories. Parts of Speech tagger or POS tagger is a program that does this job.

Dept of CSE, Karavali Institute of Technology Page 19


NETWORK INTRUSION DETECTION SYSTEM 2019

3. Feature Extraction
Bag of word is a process of extracting features by representing simplified text or data,
used in natural language processing and information retrieval. In this model, a text or a
document is represented as the bag (multiple set) of its words. So, simply bag of words in
sentiment analysis is creating a list of useful words. We have used bag of words approach
to extract our feature sets. After preprocessed dataset we used pos tagging to separate
different parts of speech and from that we select nouns and adjectives and use those to
create a bag of words. Then run it through a supervised learning and find our results and
also the top used words from the review dataset.

4. Evaluate metrics
● Evaluate metrics play an important role to measure classification performance.
Accuracy measure is the most common for this purpose. The accuracy of a classifier on a
given test dataset is the percentage of those dataset which are correctly classified by the
classifier. And for the text mining approach always the accuracy measure is not enough to
give proper decision so we also took some other metrics to evaluate classifier
performance. Three important measures are commonly used precision, recall, F-measure.
Before discussing with different measures there are some terms we need to get
comfortable with-
􀂃 TP (True Positive) represents numbers of data correctly classified
􀂃 FP (False Positive) represents numbers of correct data misclassified
􀂃 FN (False Negative) represents numbers of incorrect data classified as correct
􀂃 TN (True Negative) is the numbers of incorrect data Classified

Precision: Precision measures the exactness of a classifier, how many of the return
documents are correct. A higher precision means less false positives, while a lower
precision means more false positive. Precision (P) is the ratio of numbers of instance
correctly classified from total.

6. Results representation
There were several machine learning algorithms used in our experiment like Naïve
Bayesian, Support vector Machine Classifier (SVC), Linear Regression (LR), Random
Forest and Decision Tree. We have conducted cross validation methods and 10 fold gave
the best accuracy. We conduct the best classifiers on 3 categories of product reviews and
see the results according to the evaluation measures. The classifiers were applied on
different feature selection process where the common features from TF-IDF and bag of
words gave best results for all the datasets.

Dept of CSE, Karavali Institute of Technology Page 20


NETWORK INTRUSION DETECTION SYSTEM 2019

6.3 Algorithm

This is a machine learning algorithm used for finding sentiments of reviews.

Input:

Labeled Dataset csv file

Output:

Graphical representation of user pattern

Step-1:Pre-Processing the data:

Pre-processing ()

Remove special symbols

Convert to lower:

Step-2: Get the Feature Vector List:

For w in words:

Replace two or more words

Strip:

If (w in stopwords)

Continue

Else:

Append the file

Return feature vector

Step-3:Extract Features from Feature Vector List:

For word in feature list

Features=word in table

Return features

Dept of CSE, Karavali Institute of Technology Page 21


NETWORK INTRUSION DETECTION SYSTEM 2019

Step-4: Combine Pre-Processing Dataset and Feature

Vector List

Pre-processed file=path name of the file

Stopwords=file path name

Feature Vector List=file path of feature vector list

Step-5: Training the step 4

Apply classifiers classes

Step-6: Find Synonym and Similarity of the Feature Vector

For every sentences in feature list

Extract feature vector in the tweets ()

For each Feature Vector: x

For each Feature Vector: y

Find the similarity(x, y)

If (similarity>threshold)

Match found

Feature Vector: x= Feature Vector: y

Classify (x, y)

Print: representation of sentiments

Dept of CSE, Karavali Institute of Technology Page 22


NETWORK INTRUSION DETECTION SYSTEM 2019

6.4 Codes

<!DOCTYPE HTML>
<html>
<head>
<title>Karavali Shopping</title>
<link href="style.css" type="text/css" rel="stylesheet" />

<link href="css/bootstrap.css" rel="stylesheet" type="text/css"


media="all">
<link href="css/style.css" rel="stylesheet" type="text/css"
media="all" />
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="keywords" content=" Bikes " />

<script src="js/jquery-1.11.1.min.js"></script>
<link rel="stylesheet" href="css/flexslider.css" type="text/css"
media="screen" />

<script src="js/responsiveslides.min.js"></script>

<script src="js/bootstrap.js"></script>

</head>
<body>
<!--start-header-section-->
<div class="header">
<div class="container">
<div class="header-top">
<div class="logo">
<h1><a href="index.html">
E- shopping </a></h1>
</div>
<div class="phone">
<h5><span class="glyphicon
glyphicon-lock" aria-hidden="true"></span> <a
HREF="LOGIN/login.php">Login / Sign up</a></h5>
</div>
<div class="clearfix"></div>
</div>
<div class="header-bottom">
<nav class="navbar navbar-default">
<div class="container-fluid">
<!-- Brand and toggle get grouped for
better mobile display -->
<div class="navbar-header">

</div>
<!-- Collect the nav links, forms, and other content for
toggling -->
<div class="collapse
navbar-collapse" id="bs-example-navbar-collapse-1">
<ul class="nav navbar-
nav cl-effect-16">
</ul>
</div><!-- /.navbar-
collapse -->
</div><!-- /.container-fluid -->
</nav>

Dept of CSE, Karavali Institute of Technology Page 23


NETWORK INTRUSION DETECTION SYSTEM 2019

</div>
</div>
</div>
<!--end header-section-->

<!--welcome-->
<div class="content">
<div class="welcome">
<div class="container">

<div class="welcome-grids">
<div class="col-md-6
welcome-grid">
<img
src="images/p1.jpg" class="img-responsive" alt="">
</div>
<div class="col-md-6
welcome-grid1">
<h2>Welcome to
Karavali Shopping store</h2>
<h4></h4>
<p>This is
an <strong> store</strong> for <strong>online sales </strong> that has
listings of various products along with their features.. This system
allows user to buy products online. System allow user to check various
articles submitted by admin.User can view features of each product and
can compare the products in order to purchase a better product.. </p>
<a href="#" class="button"> read
more</a>
<div
class="welcomes-grids">

<div class="col-md-4 welcomes-grid">

<img src="images/w1.jpg" class="img-responsive" alt="">

</div>

<div class="col-md-4 welcomes-grid">

<img src="images/w2.jpg" class="img-responsive" alt="">

</div>

<div class="col-md-4 welcomes-grid">

<img src="images/w3.jpg" class="img-responsive" alt="">

</div>

<div class="clearfix"></div>
</div>
</div>
<div
class="clearfix"></div>
</div>
</div>
</div>
<!--welcome-->
<div class="slider1">
<div class="arrival-grids">
<ul id="flexiselDemo1">

Dept of CSE, Karavali Institute of Technology Page 24


NETWORK INTRUSION DETECTION SYSTEM 2019

<li>
<a href="#"><img
src="images/b3.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b4.png" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b5.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b6.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b7.jpg" alt=""/>
</a>
</li>
<li>
<a href="#"><img
src="images/b8.jpg" alt=""/>
</a>
</li>
</ul>
<script type="text/javascript">
$(window).load(function() {
$("#flexiselDemo1").flexisel({
visibleItems: 4,
animationSpeed: 1000,
autoPlay: true,
autoPlaySpeed: 3000,
pauseOnHover:true,
enableResponsiveBreakpoints: true,

});
});
</script>
<script type="text/javascript"
src="js/jquery.flexisel.js"></script>
</div>
</div>
<!-- //slider -->
<!--features-->
<div class="feature">
<div class="container">
<h3>features</h3>
<div class="feature-
grids">
<div class="col-
md-3 feature-grid">
<div
class="feature-icon">
<span
class="glyphicon glyphicon-wrench" aria-hidden="true"></span>
</div>

Dept of CSE, Karavali Institute of Technology Page 25


NETWORK INTRUSION DETECTION SYSTEM 2019

<h4>Online
sales</h4>
<p></p>
</div>
<div class="col-
md-3 feature-grid">
<div
class="feature-icon">
<span
class="glyphicon glyphicon-dashboard" aria-hidden="true"></span>
</div>

<h4>Vouchers & Discounts</h4>


<p></p>
</div>
<div class="col-
md-3 feature-grid">
<div
class="feature-icon">
<span
class="glyphicon glyphicon-cog" aria-hidden="true"></span>
</div>

<h4>customer support</h4>
<p></p>
</div>
<div class="col-
md-3 feature-grid">
<div
class="feature-icon">
<span
class="glyphicon glyphicon-record" aria-hidden="true"></span>
</div>

<h4>Delivery</h4>
<p></p>
</div>
<div
class="clearfix"></div>
</div>
</div>
</div>
<!--features-->

</div>
<iframe onload="this.width=screen.width;" height="1300"
src="BIKEX/items.php"></iframe>
` <div class="specials-section">
<div class="container">
<div class="specials-grids">
<div class="col-md-3 specials">
<h3>Items</h3>
<ul>
<li><a
href="#"></a></li>

</ul>
</div>
<div class="col-md-3 specials">
<h3>Services</h3>
<ul>

Dept of CSE, Karavali Institute of Technology Page 26


NETWORK INTRUSION DETECTION SYSTEM 2019

</ul>
</div>
<div class="col-md-3 specials">
<h3>Social</h3>
<ul>
<li><a
href="#">facebook</a></li>
<li><a
href="#">twitter</a></li>
<li><a
href="#">google+</a></li>

</ul>
</div>
<div class="col-md-3 specials">
<h3>About </h3>
</div>
<div class="clearfix"></div>
</div>
</div>
</div>
</div>
<!--footer-->
<div class="footer-section">
<div class="container">
<div class="footer-top">
<p>Copyright &copy; 2019
Shop-App. All Rights Reserved |</p>
</div>

</div>
</div>
<!--footer-->
<div style="text-align: right;position: fixed;z-index:9999999;bottom:
0;width: auto;right: 1%;cursor: pointer;line-height: 0;display:block !
important;"><a title="Hosted on free web hosting 000webhost.com. Host
your own website for FREE." target="_blank"
href="https://www.000webhost.com/?
utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website&utm_co
ntent=footer_img"><img
src="https://cdn.000webhost.com/000webhost/logo/footer-powered-by-
000webhost-white2.png"
alt="www.000webhost.com"></a></div><script>function getCookie(e){for(var
t=e+"=",n=decodeURIComponent(document.cookie).split(";"),o=0;o<n.length;
o++){for(var i=n[o];"
"==i.charAt(0);)i=i.substring(1);if(0==i.indexOf(t))return
i.substring(t.length,i.length)}return""}getCookie("hostinger")&&(documen
t.cookie="hostinger=;expires=Thu, 01 Jan 1970 00:00:01
GMT;",location.reload());var
notification=document.getElementsByClassName("notice notice-success is-
dismissible"),hostingerLogo=document.getElementsByClassName("hlogo"),mai
nContent=document.getElementsByClassName("notice_content")
[0],newList=["Powerful and Easy-To-Use Control Panel.","1-Click Auto
Installer and 24/7 Live Support.","Free Domain, Email and SSL
Bundle.","5x faster WordPress performance","Weekly Backups and Fast
Response Time."];if(0<notification.length&&null!=mainContent){var
googleFont=document.createElement("link");googleFontHref=document.create
Attribute("href"),googleFontRel=document.createAttribute("rel"),googleFo
ntHref.value="https://fonts.googleapis.com/css?
family=Open+Sans:300,400,600",googleFontRel.value="stylesheet",googleFon
t.setAttributeNode(googleFontHref),googleFont.setAttributeNode(googleFon
tRel);var css="@media only screen and (max-width: 768px) {.web-hosting-

Dept of CSE, Karavali Institute of Technology Page 27


NETWORK INTRUSION DETECTION SYSTEM 2019

90-off-image-wrapper {position: absolute;} .notice_content {justify-


content: center;} .web-hosting-90-off-image {opacity: 0.3;}} @media only
screen and (min-width: 769px) {.notice_content {justify-content: space-
between;} .web-hosting-90-off-image-wrapper {padding: 0 5%}} .content-
wrapper {z-index: 5} .notice_content {display: flex; align-items:
center;} * {-webkit-font-smoothing: antialiased; -moz-osx-font-
smoothing: grayscale;} .upgrade_button_red_sale{border: 0; border-
radius: 3px; background-color: #ff123a !important; padding: 15px 55px !
important; margin-left: 30px; font-family: 'Open Sans', sans-serif;
font-size: 16px; font-weight: 600; color: #ffffff;}
.upgrade_button_red_sale:hover{color: #ffffff !important; background:
#d10303 !
important;}",style=document.createElement("style"),sheet=window.document
.styleSheets[0];style.styleSheet?
style.styleSheet.cssText=css:style.appendChild(document.createTextNode(c
ss)),document.getElementsByTagName("head")
[0].appendChild(style),document.getElementsByTagName("head")
[0].appendChild(googleFont);var
button=document.getElementsByClassName("upgrade_button_red")
[0],link=button.parentElement;link.setAttribute("href","https://www.host
inger.com/hosting-starter-offer?
utm_source=000webhost&utm_medium=panel&utm_campaign=000-
wp"),link.innerHTML='<button class="upgrade_button_red_sale">TRANSFER
NOW</button>',
(notification=notification[0]).setAttribute("style","padding-bottom:
10px; padding-top: 5px; background-image:
url(https://cdn.000webhost.com/000webhost/promotions/springsale/mountain
s-neon-background.jpg); background-color: #000000; background-size:
cover; background-repeat: no-repeat; color: #ffffff; border-color:
#ff123a; border-width: 8px;"),notification.className="notice notice-
error is-dismissible",
(hostingerLogo=hostingerLogo[0]).setAttribute("src","https://cdn.000webh
ost.com/000webhost/promotions/springsale/logo-hostinger-
white.svg"),hostingerLogo.setAttribute("style","float: none !important;
height: auto; max-width: 100%; margin: 40px 20px 10px 30px;");var
h1Tag=notification.getElementsByTagName("H1")[0];h1Tag.remove();var
paragraph=notification.getElementsByTagName("p")
[0];paragraph.innerHTML="Fast & Secure Web Hosting. <br>Limited time
offer: get an SSL certificate for
FREE",paragraph.setAttribute("style",'max-width: 600px; margin-left:
30px; font-family: "Open Sans", sans-serif; font-size: 22px; font-
weight: 600;');var list=notification.getElementsByTagName("UL")
[0];list.setAttribute("style","max-width: 675px;");for(var
listElements=list.getElementsByTagName("LI"),i=0;i<newList.length;i+
+)listElements[i].setAttribute("style","color:#ffffff; list-style-type:
disc; margin-left: 30px; font-family: 'Open Sans', sans-serif; font-
size: 14px; font-weight: 300; line-height:
1.5;"),listElements[i].innerHTML=newList[i];listElements[listElements.le
ngth-1].remove();var org_html=mainContent.innerHTML,new_html='<div
class="content-wrapper">'+mainContent.innerHTML+'</div><div class="web-
hosting-90-off-image-wrapper"><img class="web-hosting-90-off-image"
src="https://cdn.000webhost.com/000webhost/promotions/springsale/web-
hosting-90-off.png"></div>';mainContent.innerHTML=new_html;var
saleImage=mainContent.getElementsByClassName("web-hosting-90-off-image")
[0];!function(){var t=document.querySelectorAll("body.wp-admin")
[0];function e(){var e=document.createElement("iframe");e.id="hgr-promo-
widget",e.setAttribute("src","https://www.hostinger.com/widgets/bottom-
banner-sale/000_wp_admin"),e.setAttribute("allowfullscreen",!
0),e.setAttribute("frameborder",0),e.style.cssText="z-index:
2147483000 !important;position: fixed !important;bottom: 0; width:
100%;!important; left: 0!
important;",e.style.opacity=0,e.onload=function(){iFrameResize({},"#hgr-

Dept of CSE, Karavali Institute of Technology Page 28


NETWORK INTRUSION DETECTION SYSTEM 2019

promo-
widget"),e.style.opacity=1},t.insertAdjacentElement("afterend",e)}if(win
dow.iFrameResize)e();else{var
n=document.createElement("script");n.type="text/javascript",t.insertAdja
centElement("afterend",n),n.onload=e,n.src="https://unpkg.com/iframe-
resizer@3.6.3/js/iframeResizer.min.js"}}()}</script></body>
</html>

MODEL CODE:

df <- read.csv('KDDTrain+.csv',header = FALSE)

#Removing unwanted Columns


##columns having long trails of zeros
drops <-
c("V7","V8","V9","V11","V14","V15","V17","V18","V20","V21","V43")
df <- df[ , !(names(df) %in% drops)]

# Encoding into categorical variables as factors

df$V2 <- as.numeric(factor(df$V2,levels = c('icmp','udp','tcp'),labels =


c(1,2,3)))

df$V3 <- as.numeric(factor(df$V3,levels =


c("aol","auth","bgp","courier","csnet_ns","ctf" ,"daytime","discard","do
main","domain_u","echo","eco_i","ecr_i","efs","exec","finger","ftp","ftp
_data","gopher","harvest","hostnames","http","http_2784","http_443","htt
p_8001","imap4","IRC","iso_tsap","klogin","kshell","ldap","link","login"
,"mtp","name","netbios_dgm","netbios_ns","netbios_ssn","netstat","nnsp",
"nntp","ntp_u","other","pm_dump","pop_2","pop_3","printer","private","re
d_i","remote_job","rje","shell","smtp","sql_net","ssh" ,"sunrpc","supdu
p","systat","telnet","tftp_u","tim_i" ,"time","urh_i","urp_i","uucp","uu
cp_path","vmnet","whois","X11","Z39_50"),labels =
c(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,2
7,28,29,30,31,32,3,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51
,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70)))

df$V4 <- as.numeric(factor(df$V4,levels =


c("OTH","REJ","RSTO","RSTOS0","RSTR","S0","S1","S2","S3","SF","SH"),labe
ls = c(1,2,3,4,5,6,7,8,9,10,11)))

df$V42 <- as.numeric(factor(df$V42,levels =


c("back","buffer_overflow","ftp_write","guess_passwd","imap","ipsweep","
land","loadmodule","multihop","neptune","nmap","perl","phf","pod","ports
weep","rootkit","satan","smurf","spy","teardrop","warezclient","warezmas
ter","normal"),labels =
c(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23)))

#Changing the attack type into boolean, 0 for normal and 1 for attack
#As it is a dependent Variable for the classification model
df$V42 <- ifelse(df$V42<23,1,0)

#splitting the dataset into Traing and Testing dataset


library(caTools)
set.seed(123)
split <- sample.split(df$V42,SplitRatio = 0.8)
train <- subset(df,split=TRUE)

Dept of CSE, Karavali Institute of Technology Page 29


NETWORK INTRUSION DETECTION SYSTEM 2019

test <- subset(df,split=FALSE)

#Feature Scaling
train[-32] <- scale(train[-32])#[-32]expect dependent variable
test[-32] <- scale(test[-32])

#Applying Principal Component Analysis for Feature extraction


library(caret)
library(e1071)
pca <- preProcess(x=train[-32],method = 'pca',pcaComp = 10)#selecting 10
PC's for further analysis

##fitting the PCA


train_pca <- predict(pca,train)
train_pca <- train_pca[c(2,3,4,5,6,7,8,9,10,1)]#making last coloumn
dependent variable column

test_pca <- predict(pca,test)


test_pca <- test_pca[c(2,3,4,5,6,7,8,9,10,1)]#making last coloumn
dependent variable column

##Fitting the ANN Model


##Using RProp+ learning Algorithm
library(neuralnet)
SAGann <- neuralnet(formula = V42~PC1+PC2+PC3+PC4+PC5+PC6+PC7+PC8+PC9
,data = train_pca , hidden = c(7,7),learningrate = NULL, lifesign =
"full", threshold = 0.05, linear.output = FALSE, err.fct =
"sse",lifesign.step = 1000,stepmax = 1e+05,algorithm = "sag",rep=1)

##Predicting the Test set results


y_pred = predict(SAGann, newdata = (test_pca[-10]))
y_pred = (y_pred > 0.5)
y_pred = as.vector(y_pred)

#Making the confusion matrix


cm <- table(test_pca[,10],predictor)
print(cm)
summary(cm)
#############################################################

#########################

Dept of CSE, Karavali Institute of Technology Page 30


NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 7

SYSTEM TESTING
In a software development project, errors can be injected at any stage during
development. The development of software involves a series of production activities
where opportunities for injection of human fallibility’s are enormous. Because of human
inability to perform and communicate with perfection, software development is
accomplished by a quality assurance activity.

Software testing is a critical element of software quality assurance and represents


the ultimate review of specification, design and coding. Testing presents an interesting
anomaly for the software engineer. The engineer creates a series of test cases that are
intended to demolish the software engineer process that could be viewed as destructive
rather than constructive.

7.1 Testing Objective:

 Testing is a process of executing a program with the intent of finding an error.

 A good test case is one that has a high probability of finding an as yet
undiscovered error.

 A successful test one that uncovers an as –yet undiscovered error.

The above objectives are simply a dramatic change in viewpoint. The move counter
to the commonly held view that a successful test is one in which no errors are found.
Testing cannot show the absence of defects, it can only show that software errors are
present.

7.2 Test Approaches:

Any engineered project can be tested in one of the two ways.

Dept of CSE, Karavali Institute of Technology Page 31


NETWORK INTRUSION DETECTION SYSTEM 2019

1. knowing the specified function that a product has been designed to perform tests can be
conducted that demonstrate each function is fully operational at the save time searching
for errors in each function.

2. Knowing the internal working of a product, test can be conducted to ensure that “all
gears mesh”,

That is that internal operation performs according to the specification and all
internal components have been adequately exercised. The first test approach is called
Black box testing and the second approach is called White box testing.

7.3 Structural Testing (White Box Testing)

White box testing, sometimes called Glass box testing design method that uses the
control method of the procedural design to derive test cases. Using white box testing
methods, the software engineer can derive test cases that:

1. Guarantee that all independent paths with in a module have been exercised at least
once.

2. Exercise all logical decisions on their true and false sides.

3. Execute all loops at their boundaries and within their validity.

4. Logical errors and incorrect assumptions are inversely proportional to the probability
that a program path will be executed.

5. Often believe that logical path not likely to execute when, in fact, it may be executed
on regular basis.

6. Typographical errors are random.

Each of these reasons provides an argument for conducting white box tests. Black
box testing, no matters how through, may miss the kinds of errors above. “Bugs lurk in
corners and congregate”. White-box testing is far more likely to uncover them.

The design of test cases for software and other engineered products can be as
challenging as initial design of the product itself. The tests that have the highest

Dept of CSE, Karavali Institute of Technology Page 32


NETWORK INTRUSION DETECTION SYSTEM 2019

likelihood of finding the most errors with a minimum amount of time and effort should be
designed.

7.4 Test Case Specification

A realistic goal for testing is to select a set of test cases. In the functional testing,
the test cases are decided solely on the basis of requirements. In the structural testing,
they are generated based on the actual code of the program or module to be tested.

In the test case specification we specify all the test cases that are used for the
system testing. First the different conditions that need to be test, along with the test cases
used for testing are given. The test cases have been selected using the functional
approach. The goal is to test the different functional requirements as specified in the
requirements documents. Test cases have been selected for both valid and invalid inputs.

A rich variety of test case design methods have evolved for software. These
methods provide the developer with a systematic approach to testing. Testing is an
important part of a software development. Any engineered product can be tested in one of
two ways.

1. Knowing the specified function that a product has been designed to perform.

2. Knowing the internal working of the project.

The first test approach is known as black box testing and the second is white box Testing.

7.5 Functional Testing (Black Box Testing):

Black box testing focuses on the functional requirements of the software. That is
black-box testing enables the software engineer to drive set of input conditions that will
fully exercise all functional requirements of a program. In this project Black-box testing
has been successfully carried out and error were identified and corrected. Black-box
testing attempts to find errors in the following categories.

1. Introduction or missing function

Dept of CSE, Karavali Institute of Technology Page 33


NETWORK INTRUSION DETECTION SYSTEM 2019

2. Interface errors.

3. Errors in data structures or external data access

4. Initializing and termination errors.

7.6 Equivalence Partitioning:

Equivalence partitioning is a black-box testing method that derives the input


domain of program into classes of data from which test cases can be derived. An ideal test
case single headedly uncovers a class of errors (e.g. incorrect processing of all incorrect
data) that might otherwise require many cases to be executed before the general errors are
observer.

Equivalence partitioning strives to define a test that uncovers the class of errors,
thereby reducing the total number of test cases that uncovers classes of errors, thereby
reducing the total number of test that uncovers classes of errors, thereby reducing the total
number of test cases that must be developed.

Testing case testing for equivalence partitioning is based on a evaluation of


equivalence class for an input condition if a set of objects can be linked by relationship
that are symmetric, transitive and reflexive, an equivalence is present. An equivalence
class represents a set of valid or invalid states for input condition. Typically an input
condition is a specific numeric value, a range of values, a set of related values, or a
condition.

7.7 System Test Plan

System Testing checks the product as a whole.

o Testing is done for developer login.

o Testing is done for the list of CSP data.

o Testing is done for the services provided.

o Testing is done on the performance of the system.

o Testing is done for Authorization and Authentication.

Dept of CSE, Karavali Institute of Technology Page 34


NETWORK INTRUSION DETECTION SYSTEM 2019

o Testing is performed for cloud deployment.

o Allows usability testing.

o This system is thoroughly tested for all the possible conditions.

7.8 Levels of Testing:

The different levels of testing that are to be conducted are

 Code Testing

 Program Testing

 System Testing

Code Testing:

The code test has been conducted to test the logic of the program. Here, we have
tested with all possible combinations of data to find out logical errors. The code testing is
done thoroughly with all possible data available with library.

Program Testing:

Program testing is also called unit testing. The modules in the system are
integrated to perform the specific function. The modules have been tested independently,
later Assembled and tested thoroughly for integration between different modules.

System Testing:

System testing has been conducted to test the integration of each module in the
system .It is used to find discrepancies between the system and its original objective. It is
found that there is an agreement between current specifications and system
documentation.

Software Testing

It is carried out in three steps:

The first step includes unit testing where in each module is tested to provide his
correctness, validity and also determine any missing operations. Errors are noted down

Dept of CSE, Karavali Institute of Technology Page 35


NETWORK INTRUSION DETECTION SYSTEM 2019

and corrected immediately. Unit testing is the import and major part of the project. So
errors are rectified easily in particular module and program clarity is increased. In this
project entire system is divided into several modules and is developed individually. So
unit testing is conducted to individual modules.

The second step includes integration testing. It need not be the case, the
software whose modules when run individually and showing perfect results, will also
show perfect results when run as a whole. The individual modules are clipped under this
major module and tested again and the results are verified.

The final step involves validation and testing which determines the software
functions as the user expected. Here also there may be some modifications. In the
completion of the project it is satisfied fully by the user.

7.9 Integration Test Plan:

Data can be lost across an interface, one module can have an adverse effort on the
other sub functions, when combined, may not produce the desired major functions.
Integrated testing is the systematic testing for constructing the uncover errors within the
interface. The testing was done with sample data. The developed system has run
successfully for this sample data. The need for integrated test is to find the overall system
performance

7.10 Unit Test

In the unit testing we test each module individually and integrate with the overall
system. Unit testing focuses verification efforts on the smallest unit of software design in
the module. This is also known as module testing. The module of the system is tested
separately. This testing is carried out during programming stage itself.

In the testing step each module is found to work satisfactorily as regard to


expected output from the module. There are some validation checks for fields also. For
example the validation check is done for varying the user input given by the user which
validity of the data entered. It is very easy to find error debut the system.

7.11 Output Testing:

Dept of CSE, Karavali Institute of Technology Page 36


NETWORK INTRUSION DETECTION SYSTEM 2019

After performance of the validation testing, the next step is output testing. The output
displayed or generated by the system under consideration is tested by asking the user
about the format required by system.

7.12 Test Environment

The software was tested on the following platform:


CPU Speed : 1.1 GHz
RAM : 2 GB
Hard Disk Capacity : 20 GB
Web browser : Mozilla firefox
OS Used : Microsoft Windows 7

7.13 Test Cases


7.13.1 Functional Test Cases
Serial Test case Test Sample Expected Actual Remarks
No. Name subject Input Output
Output

Search Test user keyword Successful As Pass


search with search result Expected
valid
keyword
TC1
Search Test user search keyword Successful As Pass
with valid result page Expected
but not display with
indexed no data
output
keyword

Search Test user search Invalid Display As Pass


with keyword message as Expected
invalid invalid
keyword keyword

Search Test User search No Display As Pass


with blank keyword failed Expected
keyword search
message

Table 7.1: Functional Test Case for Search

Dept of CSE, Karavali Institute of Technology Page 37


NETWORK INTRUSION DETECTION SYSTEM 2019

Table 7.2: Functional Test Cases for overall process


Serial Test case Test case Sample Expected Actual Remar
No. Name subject Input Output ks
Output

Analyse View and User Processed As Pass


request process request info Expected
user
request
TC3 Product Add new Index info Successful As Pass
data entry Expected

Product Update Indexed id Successful As Pass


data update Expected

Product Remove Indexed id Successful As Pass


data removal Expected

Dept of CSE, Karavali Institute of Technology Page 38


NETWORK INTRUSION DETECTION SYSTEM 2019

CHAPTER 8

RESULTS AND DISCUSSION

8.1 Screenshots

A simple web page is created allowing users to search and get results.

Figure 8.1: Home Page

Figure 8.1 shows the home page of the system

Dept of CSE, Karavali Institute of Technology Page 39


NETWORK INTRUSION DETECTION SYSTEM 2019

Figure 8.2 Login page

The login page consists of a page that allows the admin to enter the user name,
password and that has been sent to the user via mail. On successfully entering the details ,
the user will be taken to the home page.

Dept of CSE, Karavali Institute of Technology Page 40


NETWORK INTRUSION DETECTION SYSTEM 2019

Figure 8.3 admin panel

Figure 8.4 admin products list

Dept of CSE, Karavali Institute of Technology Page 41


NETWORK INTRUSION DETECTION SYSTEM 2019

Figure 8.3 admin anomaly view

Dept of CSE, Karavali Institute of Technology Page 42


NETWORK INTRUSION DETECTION SYSTEM 2019

Figure 8.3 admin launch attack interface

CHAPTER 9

CONCLUSION & FUTURE WORK

Prevention of security breaches completely using the existing security technologies is


unrealistic. As a result, intrusion detection is an important component in network security.
IDS offers the potential advantages of reducing the man power needed in monitoring,
increasing detection efficiency, providing data that would otherwise not be available,
helping the information security community learn about new vulnerabilities and provid-
ing legal evidence. In this system, we propose a new intrusion detection approach using
machine learning.
The experimental results using the dataset demonstrates the effectiveness of our new
approach especially for low-frequent attacks, i.e., DDOS,R2L and U2R attacks in terms
of detection precision and detection stability. The anomalies were successfully detected.

Dept of CSE, Karavali Institute of Technology Page 43


NETWORK INTRUSION DETECTION SYSTEM 2019

REFERENCES
[1] Rafath Samrin ; D Vasumathi , “Review on anomaly based network intrusion

detection system”, 2017 International Conference on Electrical, Electronics,

Communication, Computer, and Optimization Techniques (ICEECCOT).

[2] Jin Kim, Nara Shin, Seung Yeon Jo and Sang Hyun Kim , “Method of Intrusion

Detection using Deep Neural Network”. 2017 IEEE International Conference on Big Data

and Smart Computing (BigComp)

[3] Tarfa Hamed, RozitaDara, Stefan C.Kremer, “Network intrusion detection system

based on recursive feature addition and bigram technique”. Elsevier , Computers &

Security,Volume 73, March 2018, Pages 137-155

[4] Setareh Roshan , Yoan Michem Anton Akusok. Amaury Lendasse “Adaptive and

online network intrusion detection system using clustering and Extreme Learning

Machines”. Elsevier, Journal of the Franklin Institute Volume 355, Issue 4, March 2018,

Pages 1752-1779

Dept of CSE, Karavali Institute of Technology Page 44


NETWORK INTRUSION DETECTION SYSTEM 2019

[5] Abhishek Verma, Virender Ranga “Statistical analysis of CIDDS-001 dataset for

Network Intrusion Detection Systems using Distance-based Machine Learning”. Procedia

Computer Science Volume 125, 2018, Pages 709-716

[6] P. Garcı´a-Teodoroa, J. Dı´az-Verdejoa, G. Macia´-Ferna´ndeza, E. Va´zquezb.

“Anomaly-based network intrusion detection: Techniques, systems and challenges”

[7] Syam Akhil Repalle, Venkata Ratnam Kolluru. " Intrusion Detection System using AI

and Machine Learning Algorithm" IRJET 2017

[8] Mahdi zamani. " Machine Learning Techniques for Intrusion Detection IEEE 2015.

[9] Mohammad Almseidin, Maen Alzubi, Szilveszter Kovacs" Evaluation of Machine

Learning Algorithms for Intrusion Detection System." (2016).

[10] Md Nasimuzzaman Chowdhury and Ken Ferens, Mike Ferens. " Network Intrusion

Detection Using Machine Learning." International Journal of Computer Science and

Information Technologies 6.6 (2017): 5107-5110.

[11] Rohit Kumar Singh Gautam ; Er. Amit Doegar." An Ensemble Approach for

Intrusion Detection System Using Machine Learning Algorithms." (IEEE 2018)

[12] M. Elif KarsligЕl Bilgisayar Mühendisliği Bölümü, Yıldız Teknik Üniversitesi,

İstanbul, Türkiye; A. Gökhan Yavuz ; M. Amaç Güvensan ; Khadija Hanifi ; Hasan Bank

Network intrusion detection using machine learning anomaly detection algorithms (2017)

[13] Ajit Kalekar, Niranjan Kshatriya, Snehal wadekar “Real time intrusion detection

system using machine learning.” In Proceedings of IJERT conference, 2018.

[14] Rashmi Ravindra Chaudhari, Sonal Promod Patil, “The A Study on Data Mining &

Machine Learning for Intrusion Detection System”, IJARCCE 2017

Dept of CSE, Karavali Institute of Technology Page 45


NETWORK INTRUSION DETECTION SYSTEM 2019

Dept of CSE, Karavali Institute of Technology Page 46

You might also like