Mirror von Keyven/SecIDS-CNN (Original + DOI bleiben unter Keyven)

README.md

@@ -0,0 +1,204 @@
+---
+license: cc-by-nc-4.0
+language:
+- en
+- de
+metrics:
+- accuracy
+- f1
+- precision
+- recall
+- roc_auc
+tags:
+- IDS,
+- SecIDS-CNN
+- Cybersecurity
+- automotive
+- pi
+- jetson
+- CNN
+- fast
+- small
+---
+
+# SecIDS-CNN: Advanced Convolutional Neural Network for Intrusion Detection in Cybersecurity and Automotive Applications
+
+
+### Model Description
+
+SecIDS-CNN is a high-performance Convolutional Neural Network (CNN) model developed specifically for Intrusion Detection Systems (IDS) in cybersecurity and automotive network applications. Leveraging temporal patterns in network traffic, SecIDS-CNN identifies and classifies malicious activity with high accuracy, designed to meet the real-time security demands of vehicular and automotive networks. This model supports proactive threat mitigation, helping to protect in-vehicle and connected systems against cyber threats that could impact operational safety.
+
+- **Developed by:** Keyvan Hardani
+- **Model Type:** Convolutional Neural Network (CNN) for Intrusion Detection
+- **Languages:** English, German
+- **License:** Creative Commons Attribution Non Commercial 4.0 (cc-by-nc-4.0)
+- **Finetuned from model:** None
+
+### Model Sources
+
+- **Repository:** https://github.com/Keyvanhardani/SecIDS-CNN.git
+
+## Uses
+
+### Direct Use
+
+SecIDS-CNN can be directly deployed for real-time intrusion detection within cybersecurity monitoring systems. Its design supports seamless integration into automotive communication networks, enabling anomaly detection within complex, connected vehicular systems.
+
+### Downstream Use
+
+Potential applications include broader network monitoring platforms and integrated security systems in automotive and connected vehicle environments.
+
+### Out-of-Scope Use
+
+SecIDS-CNN is not suited for non-network data or applications outside the network security and automotive domains. Misuse may include attempts to deploy it in systems without real-time requirements or in unrelated cybersecurity needs.
+
+## Bias, Risks, and Limitations
+
+SecIDS-CNN, while highly accurate, may have a minor bias toward benign traffic when optimized for recall, which could lead to rare false negatives. Additionally, its effectiveness depends on access to live network data, essential for real-time intrusion detection.
+
+### Recommendations
+
+Users should be aware of the model’s optimal use cases in real-time network environments and its limitations in handling unrelated or non-automotive network types.
+
+
+## How to Get Started with SecIDS-CNN
+
+To get started with SecIDS-CNN, you can import the model and use it in your Python project. Follow the steps below:
+
+### Step 1: Install Dependencies
+
+Clone the repository and install the necessary dependencies:
+
+```bash
+git clone https://github.com/Keyvanhardani/SecIDS-CNN.git
+cd SecIDS-CNN
+pip install -r requirements.txt
+```
+
+### Step 2: Import the Model
+
+Once dependencies are installed, you can import the model into your Python project:
+
+```python
+from secids_cnn import SecIDSModel
+```
+
+### Step 3: Load and Use the Model
+
+To evaluate SecIDS-CNN’s real-time detection on sample network traffic data:
+
+```python
+# Initialize the model
+model = SecIDSModel()
+
+# Load your network traffic data (example)
+data = load_network_data('path/to/your/data.csv')
+
+# Make predictions
+predictions = model.predict(data)
+
+# Output results
+print("Intrusion Detection Results:", predictions)
+```
+
+This setup allows you to test SecIDS-CNN on provided sample data or integrate it into larger projects for real-time intrusion detection.
+
+## Training Details
+
+### Training Data
+
+The dataset for SecIDS-CNN consists of labeled network traffic, distinguishing between benign and malicious activity. It includes data from general network and automotive sources, with features capturing packet flows, timing, and network behavior.
+
+### Training Procedure
+
+The model’s training pipeline encompasses data preprocessing, feature extraction, and training on temporal network data patterns.
+
+#### Training Hyperparameters
+
+- **Precision Type:** FP32
+- **Batch Size:** 32
+- **Epochs:** 50
+
+### Compute Requirements
+
+SecIDS-CNN was trained on a multi-GPU setup, with optimizations for real-time performance in security-critical applications.
+
+## Evaluation
+
+### Testing Data and Metrics
+
+#### Testing Data
+
+The model was evaluated on a balanced set of benign and malicious network traffic records, sourced from both general cybersecurity and automotive domains.
+
+#### Metrics
+
+SecIDS-CNN’s evaluation included accuracy, precision, recall, F1-score, ROC curve, and AUC, chosen for their relevance to classification performance in security applications.
+
+### Results
+
+- **Accuracy:** 97.72%
+- **Precision:** 97.74%
+- **Recall:** 97.72%
+- **F1-Score:** 0.9772
+
+SecIDS-CNN demonstrated high reliability, achieving almost 98% accuracy in intrusion detection and benign traffic classification.
+
+## Model Examination
+
+Feature importance was analyzed using SHAP (SHapley Additive exPlanations) to gain insight into feature contributions. This interpretability measure supports transparency and offers guidance for refining the model for intrusion detection.
+
+- **Top Features:** Packet_Length_Mean, Flow_Duration
+- **Least Impactful Features:** Bwd_Packet_Length_Mean, Idle_Mean
+
+## Environmental Impact
+
+The estimated carbon footprint for training SecIDS-CNN was calculated using the [Machine Learning Impact calculator](https://mlco2.github.io/impact#compute).
+
+- **Hardware:** Multi-GPU setup (NVIDIA RTX 4070, RTX 4090Ti)
+- **Training Duration:** 
+
+  Batch Size: 32
+  Epochs: 50
+  Training Duration: ~72 hours on RTX 4090Ti
+  Emissions: ~15 kg CO₂
+
+## Technical Specifications
+
+### Model Architecture
+
+SecIDS-CNN utilizes a multi-layer convolutional architecture, optimized for high-throughput analysis of network traffic data, with an emphasis on capturing time-based patterns.
+
+### Compute Infrastructure
+
+- **Software:** TensorFlow, Python, Keras
+
+### Supported Hardware
+
+This model is lightweight and versatile for inference across a wide range of hardware, including:
+
+- **CPUs**: Compatible with standard CPUs, allowing easy deployment on nearly any system.
+- **GPUs**: Optimized for all GPUs (primarily used for training), but also enables faster inference if needed.
+- **Microcontrollers and Edge Devices**: With a small model size (~700 KB), it supports microprocessors and edge devices, such as Raspberry Pi, NVIDIA Jetson Nano, and other embedded systems.
+
+This compatibility ensures flexibility for various applications in automotive and cybersecurity environments.
+
+## Citation
+
+**BibTeX:**
+
+```bibtex
+@misc{secids-cnn,
+  author = {Keyvan Hardani},
+  title = {SecIDS-CNN: Advanced Convolutional Neural Network for Intrusion Detection},
+  year = {2023},
+  note = {Available under CC BY-NC 4.0}
+}
+@misc {keyvan_hardani_2024,
+	author       = { {Keyvan Hardani} },
+	title        = { SecIDS-CNN (Revision 5daf4a4) },
+	year         = 2024,
+	url          = { https://huggingface.co/Keyven/SecIDS-CNN },
+	doi          = { 10.57967/hf/3351 },
+	publisher    = { Hugging Face }
+}

SecIDS-CNN.h5

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:65ea9c607a99c39cfc291d5ad8a087c6968d686ac6e7b5b3e0b841ff7e402b20
+size 727136

config.json

@@ -0,0 +1,23 @@
+{
+  "_name_or_path": "SecIDS-CNN",
+  "architectures": [
+    "CNNForBinaryClassification"
+  ],
+  "model_type": "cnn",
+  "input_shape": [10, 1],
+  "num_classes": 2,
+  "num_conv_layers": 2,
+  "conv_filters": [32, 64],
+  "kernel_sizes": [3, 3],
+  "pooling_type": "none",
+  "batch_norm": true,
+  "dense_units": [128, 1],
+  "activation_hidden": "relu",
+  "activation_output": "sigmoid",
+  "dropout_rate": 0.3,
+  "loss_function": "binary_crossentropy",
+  "optimizer": "adam",
+  "metrics": ["accuracy"],
+  "transformers_version": "4.38.1"
+}
+

requirements.txt

@@ -0,0 +1,3 @@
+tensorflow==2.11.0       # Ensure compatibility with your model version
+pandas==1.5.2            # For handling data in DataFrames
+numpy==1.23.5            # Required by TensorFlow and often useful for data processing

run_model.py

@@ -0,0 +1,14 @@
+import pandas as pd
+from secids_cnn import SecIDSModel
+
+# Step 1: Initialize the model
+model = SecIDSModel()
+
+# Step 2: Load network traffic data (replace 'path/to/your/data.csv' with the actual path)
+data = pd.read_csv('path/to/your/data.csv')
+
+# Step 3: Make predictions
+predictions = model.predict(data)
+
+# Output results
+print("Intrusion Detection Results:", predictions)

secids_cnn.py

@@ -0,0 +1,22 @@
+import tensorflow as tf
+import pandas as pd
+
+class SecIDSModel:
+    def __init__(self, model_path="SecIDS-CNN.h5"):
+        # Load the trained model
+        self.model = tf.keras.models.load_model(model_path)
+
+    def predict(self, data):
+        # Preprocess data if needed (assume data is a Pandas DataFrame)
+        processed_data = self.preprocess_data(data)
+        
+        # Make predictions
+        predictions = self.model.predict(processed_data)
+        
+        # Convert predictions to readable format if needed
+        return ["Attack" if pred > 0.5 else "Benign" for pred in predictions]
+
+    def preprocess_data(self, data):
+        # Placeholder for preprocessing logic, adjust according to your needs
+        # For example, you may need to scale or reshape data
+        return data.values