Anomaly based analysis of network traffic with machine learning methods

As technology and the internet have become an indispensable part of our daily lives, access to the internet has become of vital importance for many sectors. This situation has also increased the number and impact of cyber attacks, making protecting systems from attacks an issue that needs to be considered. Cyber security has begun to be accepted as a new important element in the defense strategies of countries, and many countries, public and private sectors, have taken and continue to take important steps in the field of cyber defense. In order to be protected from attacks occurring on computer networks and to prevent them as much as possible, the use of Intrusion Detection Systems has been evaluated as one of the most important issues in securing data. In this context, in the thesis study, studies on intrusion detection systems were meticulously examined and machine learning methods the UNSW-NB15 dataset Logistic regression, K-nearest neighbor algorithm, Support Vector Machines, Naive Bayes, Decision Tree and Random Forest were trained and tested has been subjected to stages. Normal network traffic was taught to the machine learning methods used in the training phase and a reference model was created with this information. In the testing phase, the created model tries to detect abnormal activities by monitoring network traffic. If the system detects deviations from the established normal behavior, it considers there to be a potential attack or threat. Finally, the success rates of the algorithms in detecting anomaly traffic were evaluated using the confusion matrix.