Emulator environment design for network anomaly detection and attack detection with machine learning

The emergence of the Internet and the rapid increase of connected devices have brought many advantages. In addition to these advantages, it has also presented us with significant challenges. Among these challenges, cyber threats stand out as the most important issue that requires urgent intervention. These attacks, which target individuals, organisations and even entire nations, have the potential to cause emotional and psychological damage as well as material losses. In the light of these adverse situations, the aim of this research is to conduct a comprehensive analysis of various machine learning techniques in order to develop anomaly-based detection systems that can accurately identify and detect network attacks. In this thesis, the emulator was used to generate five different data sets. Experimental studies were carried out using three different feature selection methods. These methods are recursive, forward-oriented and manual feature selection. Data augmentation was performed by applying Synthetic Minority Oversampling Technique to handle unbalanced datasets. Accuracy rates for all potential results were calculated using classification algorithms including Random Forest, Black Trees, Nearest Neighbour and Support Vector Machine. These calculations were performed using Python programming language and libraries such as Sklearn, NumPy, Pandas and Matplotlib. Among the machine learning algorithms, especially Random Forest, Decision Trees and Nearest Neighbour algorithms gave the highest level of performance and success in intrusion detection systems. The accuracy rates of these three algorithms were generally between 99.90% and 100%. This shows that these algorithms are highly effective for intrusion detection. It was observed that the application of synthetic data augmentation did not have a significant effect on the results. Thanks to this thesis study, in-depth examination, monitoring and analysis of the data patterns and volume in the network will contribute to the development of a reliable Intrusion Detection System that will enable the network to function properly and allow information sharing to take place securely.