How to clean up network traffic capture (pcap and csv) for Anomaly detection ?

[osm1n]

Hi All,
I have a captured network traffic within a small home network in CSV format. The captured traffic consists of benign and attack traffic which is already labeled.

I have been trying to feed this dataset into river and perform anomaly detection using the example here - https://riverml.xyz/latest/api/anomaly/HalfSpaceTrees/

I was able to pass the dataset into dict using this command -
dataset = [(x, x.pop("class")) for x in dataset.to_dict(orient = "records")]

Below is an entry in the dataset as a dict
{'frame.len': 206,
'ip.flags.df': 1,
'ip.flags.rb': 0,
'ip.frag_offset': 0,
'ip.hdr_len': 20,
'ip.len': 192,
'ip.proto': 6,
'ip.ttl': 128,
'p.flags.mf': 0,
'tcp.ack': 1,
'tcp.dstport': 22,
'tcp.flags.ack': 1,
'tcp.flags.cwr': 0,
'tcp.flags.ecn': 0,
'tcp.flags.fin': 0,
'tcp.flags.ns': 0,
'tcp.flags.push': 1,
'tcp.flags.res': 0,
'tcp.flags.reset': 0,
'tcp.flags.syn': 0,
'tcp.flags.urg': 0,
'tcp.len': 152,
'tcp.srcport': 4175,
'tcp.time_delta': 0.0,
'tcp.window_size': 16697}

However when i try to pass dataset into the hst model using this command

for x in dataset[:3]:
hst = hst.learn_one({'x': x})

i encounter the error below:
TypeError: '<' not supported between instances of 'tuple' and 'float'

please how do i clean up this dataset to work with anomaly detection module in river ?

The goal of the project is to build a real time DDoS attack detection system using river. Every incoming traffic will be analyzed by river anomaly module and classify it as attack or benign traffic.

[MaxHalford]

Sounds like a cool project!

Pretty sure you just have to pass x to learn_one. You don't need to create a nested dict like you're doing.

Sorry for the poor formatting, I'm on my phone.

[MaxHalford]

Also, if you have labeled data, you don't need to do unsupervised learning. You can do supervised learning.

[osm1n]

Thanks Max, it worked. Really appreciate what you guys are doing with river.

[timon-eth]

Adjust the Dataset Format
First, ensure that the data passed to the learn_one method is in the right format. Currently, you're passing the dataset entry as a tuple due to how you're unpacking the data in the loop.
The dataset should contain tuples like (features_dict, label), and you need to feed only the features_dict to the learn_one method.