Designing machine learning based intrusion detection and analysis system for network security via honeypot

In this thesis, studies have been carried out to combat cyber-attacks, which are the biggest technological problem of today with the development of technology with an accelerated increase day by day. The scope of the work is to design a live system by combining honeypot technology with machine learning based intrusion detection application. In the first part of the study, an open source t-pot honeypot system was built for honeypot technology to analyze network traffic and detect anomalies in the network. In this study, the UNSW-NB15 dataset prepared by the Australian Cyber Security Center was used. In addition, the open source WEKA application developed by the University of Waikato was used for the application of machine learning algorithms. In the application, normalization and feature selection were performed on the dataset. Then the model was trained with machine learning algorithms. In the second phase of the thesis, a .Net Core MVC-based application was developed and the SVM learning model was integrated for real-time listening, analysis and intrusion detection. When an attack is detected, the application presents it graphically to the user and provides information about the first measures that can be taken afterwards. It provides fast and effective recommendations to the user with a real-time detection system. In addition, the study provides information on how it can be used more efficiently by combining honeypot technologies and machine learning technology. It has also shown that users can develop their own analysis systems with open source software.