Add an AI/ML model implementation that detects abnormal behaviors (Intrusion, DDOS, ...) based on the encrypted traffic.
This involves to proxy to log anonymous data to provide the model with features such as packet sizes, intervals, connection durations.
Model suggestions:
- Isolation Forest
- KitNET from Kitsune ⭐
Both unsupervised learning so we should have a dataset of normal traffic for training.
Other considerations:
- data-driven development with Kafka
Add an AI/ML model implementation that detects abnormal behaviors (Intrusion, DDOS, ...) based on the encrypted traffic.
This involves to proxy to log anonymous data to provide the model with features such as packet sizes, intervals, connection durations.
Model suggestions:
Both unsupervised learning so we should have a dataset of normal traffic for training.
Other considerations: