{"id":24708454,"url":"https://github.com/tanishq-ctrl/cyberattack-analysis-and-insights","last_synced_at":"2025-06-28T13:35:03.999Z","repository":{"id":268117192,"uuid":"903367444","full_name":"tanishq-ctrl/Cyberattack-Analysis-and-Insights","owner":"tanishq-ctrl","description":"This repository contains an in-depth analysis of a cybersecurity dataset. The primary goal is to identify patterns, vulnerabilities, and trends in cyberattacks by leveraging various visualizations and statistical insights. The project provides actionable insights for enhancing cybersecurity measures.","archived":false,"fork":false,"pushed_at":"2024-12-14T14:16:10.000Z","size":12322,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-27T06:34:49.959Z","etag":null,"topics":["cyberattack","cyberattacks","data-science","data-visualization","dataanalysis","dataanalysisusingpython","dataanalytics"],"latest_commit_sha":null,"homepage":"https://github.com/tanishq-ctrl/Cyberattack-Analysis-and-Insights","language":"Jupyter Notebook","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tanishq-ctrl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-14T12:28:43.000Z","updated_at":"2025-01-14T09:51:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"7f3f2cee-eb34-46da-93f2-55edccbf016d","html_url":"https://github.com/tanishq-ctrl/Cyberattack-Analysis-and-Insights","commit_stats":null,"previous_names":["tanishq-ctrl/cyberattack-analysis-and-insights"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tanishq-ctrl%2FCyberattack-Analysis-and-Insights","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tanishq-ctrl%2FCyberattack-Analysis-and-Insights/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tanishq-ctrl%2FCyberattack-Analysis-and-Insights/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tanishq-ctrl%2FCyberattack-Analysis-and-Insights/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tanishq-ctrl","download_url":"https://codeload.github.com/tanishq-ctrl/Cyberattack-Analysis-and-Insights/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244913324,"owners_count":20530817,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyberattack","cyberattacks","data-science","data-visualization","dataanalysis","dataanalysisusingpython","dataanalytics"],"created_at":"2025-01-27T06:32:05.165Z","updated_at":"2025-03-22T06:14:38.230Z","avatar_url":"https://github.com/tanishq-ctrl.png","language":"Jupyter Notebook","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cybersecurity Analysis and Insights\n\n## Introduction\nThis repository contains an in-depth analysis of a cybersecurity dataset. The primary goal is to identify patterns, vulnerabilities, and trends in cyberattacks by leveraging various visualizations and statistical insights. The project provides actionable insights for enhancing cybersecurity measures.\n\n## Dataset Description\nThe dataset includes records of network activity and potential cyberattacks. It contains the following key features:\n\n- **Timestamp**: Date and time of the event.\n- **Source IP Address**: The IP address initiating the communication.\n- **Destination IP Address**: The target IP address.\n- **Source Port**: The port used by the source IP.\n- **Destination Port**: The port targeted by the communication.\n- **Protocol**: The network protocol used (e.g., TCP, UDP, ICMP).\n- **Packet Length**: Size of the network packet.\n- **Packet Type**: Indicates the type of packet (Data or Control).\n- **Traffic Type**: Categorizes traffic (e.g., HTTP, DNS).\n- **Payload Data**: Captures payload content in text format.\n- **Anomaly Scores**: Assigned score indicating anomaly level.\n- **Severity Level**: Categorizes the severity of the event.\n- **Log Source**: Indicates the source generating the log (e.g., Server, Firewall).\n- **Temporal Features**: Derived features like Year, Month, Day, Hour, etc.\n\n### Dataset at a Glance\nThe dataset contains 33 columns, offering rich contextual information for analysis.\n\n---\n\n## Visualizations and Insights\n\n### 1. Top 10 Source IPs\n![Top 10 Source IPs](images/top10_sourceips_involved_in_cyberattacks.png)\n**Observations:**\n- IP `103.216.15.12` is the most active source of cyberattacks, suggesting a high-priority target for mitigation measures.\n- The distribution of attacks across IPs is relatively balanced, indicating multiple sources of threats.\n- Continuous blacklisting and monitoring of these IPs can significantly reduce attack volumes.\n\n### 2. Top 10 Destination Ports\n![Top 10 Destination Ports](images/top_10_targeted_destination_ports.png)\n**Observations:**\n- Ports such as 7508 and 25889 are the most targeted, reflecting specific application vulnerabilities or configurations.\n- The distribution is relatively even, suggesting diverse attack vectors across various services.\n- Security measures like firewall rules should focus on the top targeted ports to mitigate risks.\n\n### 3. Distribution of Packet Lengths\n![Distribution of Packet Lengths](images/Distribution_of_packet_lengths.png)\n**Observations:**\n- Packet lengths are evenly distributed, with a slight concentration around the median.\n- The smooth density curve suggests consistent traffic flow, likely dominated by normal activity.\n- Small spikes near the tails may indicate anomalies or specific types of traffic worth investigating.\n\n### 4. Attack Type vs Severity Level\n![Attack Type vs Severity Level](images/Attack_type_vs_severity_level.png)\n**Observations:**\n- All attack types (Malware, DDoS, Intrusion) are evenly distributed across severity levels, highlighting consistent impacts across categories.\n- Intrusion attacks show slightly more occurrences at medium severity, indicating a higher tendency to escalate.\n- DDoS attacks contribute significantly to high-severity incidents, emphasizing the need for mitigation strategies.\n\n### 5. Hourly Trends in Cyber Attacks\n![5. Hourly Trends in Cyber Attacks](images/Hourly_trends_in_cyber_attacks.png)\n**Observations:**\n- Cyberattacks show periodic spikes, with significant peaks during certain hours of the day, possibly indicating attacker behavior patterns or automated scripts.\n- A noticeable dip in attacks occurs during late night hours, suggesting less activity in specific time zones.\n- High variability in attack frequencies across the day indicates the need for continuous monitoring.\n\n### 6. Anomaly Scores by Severity\n![Anomaly Scores by Severity](images/Anomally_scores_dist_by_security_level.png)\n**Observations:**\n- Higher severity levels generally align with higher anomaly scores, indicating a strong correlation between anomaly detection and severity classification.\n- The range of anomaly scores increases as the severity level escalates, with low severity having a narrower distribution compared to high severity.\n- Outliers in the low and medium severity levels may warrant further investigation to refine detection algorithms.\n\n\n### 7. Top Network Segments\n![Top Network Segments](images/top5_network_segments_Attacked.png)\n**Observations:**\n- Segment C is the most targeted, indicating potential vulnerabilities or critical infrastructure.\n- All three segments show similar attack levels, suggesting widespread threats across various network areas.\n- Resource allocation and defense mechanisms should focus equally on all segments to ensure comprehensive security.\n\n### 8. Month-wise Trends\n![Month-wise Trends](images/month_wise_distribution_of_Attacks.png)\n**Observations:**\n- The first half of the year (January to June) sees higher attack frequencies, with peaks in February and April, possibly correlating with global events or attack campaigns.\n- A sharp decline in attack frequency occurs from September onward, indicating a seasonal trend.\n- The trend suggests that resources should be allocated more heavily in the earlier months to mitigate heightened activity.\n\n### 9. Alerts Breakdown\n![Alerts Breakdown](images/Breakdown_of_Alerts:Warnings.png)\n**Observations:**\n- Alerts and warnings are evenly split, suggesting balanced detection of normal and suspicious activities.\n- The high percentage of warnings (`50.2%`) indicates room for improving false positive rates.\n- A near-equal distribution highlights effective monitoring but may also reflect limitations in detection thresholds.\n\n### 10. Traffic Types\n![Traffic Types](images/Distribution_of_traffic_types_in_attacks.png)\n**Observations**\n- DNS and HTTP traffic types are most frequently associated with attacks, reflecting their ubiquity in network communications.\n- FTP traffic, although less common, still shows a considerable number of attack instances, indicating its vulnerability.\n- The even distribution highlights the need for security measures across all traffic types.\n\n### 11. Distribution of Attack Types by Browser\n![Distribution of Attack Types by Browser](images/distribution_of_attack_types_browser.png)\n**Observations:**\n- Mozilla browsers are disproportionately targeted, with Malware and Intrusion leading the attack types.\n- Opera has fewer attack instances, reflecting its smaller user base or better security measures.\n- Malware is the dominant attack type across both browsers, necessitating enhanced security protocols.\n\n### 12. Distribution of Attack Types by Device/OS\n![Distribution of Attack Types by Device/OS](images/Distribution_of_attack_types_by_device:os.png)\n**Observations:**\n- Windows devices are the most targeted, with Malware accounting for the majority of attacks.\n- Linux and MacOS also show significant vulnerabilities, particularly for Intrusion attempts.\n- Mobile devices (Android, iOS) have fewer attacks, possibly due to better isolation and security controls.\n\n### 13. Top Actions Taken\n![Top Actions Taken](images/Top_action_taken_against_attacks.png)\n**Observations:**\n- Logging is the most frequent response to attacks, indicating a focus on tracking and monitoring.\n- Ignoring certain events reflects potential false positives or low-priority attacks.\n- Blocking is a significant action, showing proactive measures to prevent recurring incidents.\n\n### 14. Protocol Usage Distribution\n![Protocol Usage Distribution](images/Distribution_of_protocols.png)\n**Observations:**\n- ICMP dominates the protocol distribution, reflecting its widespread use in most applications.\n- UDP shows significant usage, likely due to real-time data transmissions or DNS traffic.\n- TCP has the lowest count, typically associated with diagnostic or control messages.\n\n### 15. Top 5 States Affected by Cyber Attacks\n![Top 5 States Affected by Cyber Attacks](images/top5_states_affected_by_cyberattacks.png)\n**Observations:**\n- Ghaziabad and Meghalaya experiences the highest number of attacks, indicating concentrated vulnerabilities.\n- Smaller states like Nagaland and Tripura also show significant attack levels, highlighting the need for robust security measures in underrepresented areas.\n- Regional patterns may indicate specific attacker strategies or infrastructure weaknesses.\n  \n### 16. Average Packet Length by Traffic Type (Monthly Trend)\n![Average Packet Length by Traffic Type (Monthly Trend)](images/avg_packet_length_by_traffic_type_by_month.png)\n\n**Observations:**\n- DNS shows peaks during specific months, which could correlate with increased attack campaigns or system updates.\n- HTTP maintains a relatively consistent average throughout the months, reflecting stable usage patterns.\n- FTP displays sharp spikes and drops, suggesting inconsistent usage or targeted attack behaviors.\n\n### 17. Average Packet Length by Traffic Type (Yearly Trend)\n![Average Packet Length by Traffic Type (Yearly Trend)](images/average_packet_length_by_traffic_type_by_hour.png)\n**Observations:**\n- DNS traffic exhibits an increasing trend in average packet length over the years, possibly due to expanded payloads.\n- FTP shows inconsistent fluctuations, which might indicate irregular usage or varying transfer sizes.\n- HTTP maintains a steady trajectory, reflecting consistent payload sizes across its usage.\n\n---\n\n## Methodology\n### Steps Taken:\n1. **Data Cleaning**: Handled missing values and standardized formats.\n2. **Feature Engineering**: Derived additional temporal features (e.g., Day of Week, Hour).\n3. **Visualization**: Created 16 visualizations using Matplotlib and Seaborn to extract meaningful patterns.\n4. **Analysis**: Conducted storytelling for each visualization to provide actionable insights.\n\n---\n\n## Conclusion\nThis analysis offers a comprehensive view of the cyber threat landscape. Key findings include:\n- Identifying high-risk IPs, ports, and network segments.\n- Unveiling temporal patterns to optimize monitoring efforts.\n- Providing insights into attack types and severity levels for targeted defense.\n\n**Recommendations**:\n1. Prioritize monitoring high-risk IPs and ports.\n2. Fortify vulnerable network segments and devices.\n3. Regularly update protocols and browsers to address known vulnerabilities.\n4. Leverage anomaly scores to preemptively mitigate high-severity incidents.\n\nThis repository serves as a foundational resource for enhancing cybersecurity strategies and decision-making.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftanishq-ctrl%2Fcyberattack-analysis-and-insights","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftanishq-ctrl%2Fcyberattack-analysis-and-insights","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftanishq-ctrl%2Fcyberattack-analysis-and-insights/lists"}