Experimental Analysis of Network Traffic Databases for Anomaly Detection

Over the past decade, cyber threats have evolved significantly in persistence and in how they address various vulnerabilities. Therefore, they are considered to be the main weapon with which information can be exploited, whose attack phases include reconnaissance, identifying and disabling security tools, and data exfiltration. Therefore, implementing an advanced intrusion detection system based on network elements has become an inevitable line of defense. This paper provides an overview of the necessity of using machine learning methods in the activity carried out in the field of cyber security. Thus, by means of some open-source tools and libraries (the WEKA - Waikato Environment for Knowledge Analysis tool and the Scikit-Learn library), a comparative analysis of the performances of some classification algorithms is performed. The goal is to rank the classification algorithms for further analysis and for the development of a high-performance intrusion detection program.