Cyberattack Detection & Response Agent

This project implements a system to detect cyberattacks in network traffic using Machine Learning (Random Forest/XGBoost) and automates response actions using Reinforcement Learning (DQN).

Project Structure

• data/raw/: Directory for storing the CICIDS2017 CSV datasets.
• src/: Source code for the pipeline.
  • preprocessing.py: Data cleaning, encoding, normalization, and balancing.
  • detection.py: Training and evaluation of the ML detection model.
  • response.py: RL environment and DQN agent for automated response.
• models/: Directory where trained models (rf_model.pkl, dqn_model.pth) are saved.
• app.py: Streamlit web application for demonstration.

Setup

1. Install Dependencies:

   pip install -r requirements.txt

2. Data Setup:

   • Download the CICIDS2017 dataset (CSVs).
   • Place the CSV files (e.g., Monday-WorkingHours.pcap_ISCX.csv, etc.) inside the data/raw/ folder.
   • Note: The system currently includes a dummy dataset for testing purposes.

Usage

1. Train the Detection Model

Run the detection script to process data and train the Random Forest model:

python src/detection.py

This will save the model to models/rf_model.pkl.

2. Train the RL Response Agent

Run the response script to train the Deep Q-Network (DQN) agent:

python src/response.py

This will save the agent to models/dqn_model.pth.

3. Run the Web Application

Launch the Streamlit dashboard to interact with the system:

streamlit run app.py

• Select "Use Sample Data" to test with the generated dummy data.
• Select "Upload CSV" to test with real network traffic files.

Features

• Detection: Classifies traffic as Normal or Attack.
• Response: RL Agent chooses to Allow, Block, Alert, or Isolate based on the threat.
• Visualization: View detection statistics and agent decisions in the UI.