Built using the CIC-IDS-2017 dataset, the solution processes more than 2.8 million network traffic records and evaluates 12 machine learning algorithms to identify the most effective approach for attack detection.
XGBoost delivered the strongest performance during project evaluation, achieving 99.87% accuracy and 99.99% ROC-AUC. The trained system classifies 15 types of network activity and cyberattacks, helping analysts distinguish normal traffic from threats such as denial-of-service activity, brute-force attempts, botnet traffic, infiltration, port scanning, and web-based attacks.
The platform goes beyond basic classification by integrating SHAP and LIME explainability. These techniques reveal which network features contributed most to each prediction, allowing security teams to understand why specific traffic was flagged rather than relying on an unexplained model output.
A forensic timeline reconstruction module organizes suspicious events chronologically, helping analysts trace attack progression, identify related activity, and review the sequence of events surrounding an incident.
The pipeline also generates professional PDF reports containing model results, detected threats, risk summaries, explainability findings, visual evidence, and forensic timelines. This supports technical investigation, stakeholder communication, and repeatable security analysis.
The project demonstrates how machine learning, explainable AI, and forensic analytics can strengthen network monitoring and support faster, evidence-based incident response.
Need a machine learning threat-detection, cybersecurity analytics, or explainable AI solution? Let’s build a security platform tailored to your network data and investigation workflows.