Network Traffic Anomaly Detection Using k-Nearest Neighbors

k-Nearest Neighbors for Informatics and Information Systems

Field: Informatics and Information SystemsLevel: Undergraduate thesis (S1)Method: k-Nearest Neighbors

0 views

Through synthetic data, the illustrated aim is to classify anomalous traffic with k-Nearest Neighbors using connection duration and bytes sent. k-Nearest Neighbors classifies a case by the majority class of its k closest neighbours in a standardised feature space. It suits theses that need a simple, nonparametric and easily explained classifier.

Network Traffic Anomaly Detection Using k-Nearest Neighbors: result sheet

Project info

Field of studyInformatics and Information Systems
LevelUndergraduate thesis (S1)
Method typeMachine Learning
Estimated build time± 3 working days
Toolsclass::knn.cv, class::knn, pROC::roc, ggplot2
PriceUS$16 - US$100

Research goal

Through synthetic data, the illustrated aim is to classify anomalous traffic with k-Nearest Neighbors using connection duration and bytes sent.

Variables

Role	Variable	Unit
Main	Anomalous traffic	class
Supporting 1	Connection duration	s
Supporting 2	Bytes sent	KB

Example result

9Best k (LOOCV)
0.907LOOCV accuracy
0.883Accuracy (test)
0.885F1 score
0.978AUC (test)
0.839Specificity

Leave-one-out cross-validation selects k = 9 (CV accuracy 90.7%). On the test set, k-NN with standardised features classifies Anomalous traffic with 88.3% accuracy, F1 of 0.885 and AUC of 0.978; Connection duration and Bytes sent define a fairly sharp class boundary.

Computed from illustrative synthetic data, not from a real study.

About k-Nearest Neighbors

k-Nearest Neighbors classifies a case by the majority class of its k closest neighbours in a standardised feature space. It suits theses that need a simple, nonparametric and easily explained classifier.

Steps

1Prepare numeric features and the binary class variable
2Split into training and test sets, then standardise features with training means and SDs
3Choose an odd k from 1 to 25 by leave-one-out cross-validation (class::knn.cv)
4Predict the test set with the best k (class::knn, prob = TRUE)
5Compute the confusion matrix, accuracy, F1, specificity and AUC
6Plot accuracy against k, the decision regions and the confusion matrix

Assumptions to check

Features are on comparable scales (standardisation is required) because k-NN is distance based
Cases that are close in feature space tend to share the same class
Irrelevant features are limited because they blur the distances

Reading and reporting the results

Report the selected k with its cross-validated accuracy, then test accuracy, F1, specificity and AUC. The accuracy curve over k shows the trade-off between an overly complex model (small k) and an overly smooth one (large k).

Example R code

A short starting script with this project's variable names. The delivered version is adapted to your data and fully commented.

Show code

# Contoh kode R: k-Nearest Neighbors
suppressPackageStartupMessages({
  library(ggplot2)
  library(patchwork)
  library(class)
  library(pROC)
})
set.seed(42)
# ---- Gaya grafik ----
pal <- c("#1f6feb", "#e8590c", "#2f9e44", "#ae3ec9", "#f59f00")
warna <- list(bg = "#f4f6fa", panel = "#ffffff", teks = "#1f2933", redup = "#5f6b78", grid = "#e3e8ee", bar = "#1d3557")
tata <- 1
theme_set(theme_minimal(base_size = 11) + theme(legend.position = "bottom"))

# ---- Data sintetis: kelas biner dari dua fitur utama dan satu fitur tambahan ----
n <- 200
positif <- function(x, m) if (m > 0) pmax(x, 0.05 * m) else x   # cegah nilai negatif yang tidak wajar
d <- data.frame(connection_duration = positif(rnorm(n, 50, 10), 50),
                bytes_sent = positif(rnorm(n, 30, 6), 30),
                x3 = round(rnorm(n, 50, 10), 2))
z1 <- as.numeric(scale(d$connection_duration))
z2 <- as.numeric(scale(d$bytes_sent))
z3 <- as.numeric(scale(d$x3))
arah <- sample(c(-1, 1), 2, replace = TRUE)
skor <- arah[1] * runif(1, 0.8, 1.3) * z1 + arah[2] * runif(1, 0.6, 1.1) * z2 +
  sample(c(-1, 1), 1) * runif(1, 0.5, 0.9) * z1 * z2 + runif(1, 0.1, 0.35) * z3
skor <- skor - quantile(skor, runif(1, 0.4, 0.6))
d$anomalous_traffic <- rbinom(n, 1, plogis(runif(1, 2.5, 4) * skor))
write.csv(d, "data_contoh.csv", row.names = FALSE)

# ---- Pembagian data latih/uji (70:30) dan standarisasi memakai rerata/SB data latih ----
d$kelas <- factor(d$anomalous_traffic, levels = c(0, 1), labels = c("No", "Yes"))
fitur <- c("connection_duration", "bytes_sent", "x3")
idx <- unlist(lapply(split(seq_len(n), d$kelas), function(i) sample(i, round(0.7 * length(i)))))
latih <- d[idx, ]
uji <- d[-idx, ]
rerata <- sapply(latih[fitur], mean)
sb <- sapply(latih[fitur], sd)
xl <- scale(latih[fitur], center = rerata, scale = sb)
xu <- scale(uji[fitur], center = rerata, scale = sb)

# ---- Pemilihan k: validasi silang leave-one-out (class::knn.cv) untuk k ganjil 1..25 ----
daftar_k <- seq(1, 25, by = 2)
akurasi_cv <- sapply(daftar_k, function(k) mean(class::knn.cv(xl, latih$kelas, k = k) == latih$kelas))
akurasi_uji_k <- sapply(daftar_k, function(k) mean(class::knn(xl, xu, latih$kelas, k = k) == uji$kelas))
k_best <- daftar_k[which.max(akurasi_cv)]
print(data.frame(k = daftar_k, akurasi_cv = round(akurasi_cv, 3)))
cat("k terbaik (LOOCV):", k_best, "\n")

# ---- Model akhir dan evaluasi pada data uji ----
pr <- class::knn(xl, xu, latih$kelas, k = k_best, prob = TRUE)
p_menang <- attr(pr, "prob")                       # proporsi suara kelas pemenang
prob <- ifelse(pr == "Yes", p_menang, 1 - p_menang) # peluang kelas Yes
konf <- table(Actual = uji$kelas, Predicted = pr)
print(konf)
tp <- konf["Yes", "Yes"]; fp <- konf["No", "Yes"]; fn <- konf["Yes", "No"]; tn <- konf["No", "No"]
akurasi <- sum(diag(konf)) / sum(konf)
presisi <- if (tp + fp > 0) tp / (tp + fp) else 0
recall <- if (tp + fn > 0) tp / (tp + fn) else 0
spesifisitas <- if (tn + fp > 0) tn / (tn + fp) else 0
f1 <- if (presisi + recall > 0) 2 * presisi * recall / (presisi + recall) else 0
roc_knn <- pROC::roc(uji$kelas, prob, levels = c("No", "Yes"), direction = "<", quiet = TRUE)
auc_knn <- as.numeric(pROC::auc(roc_knn))
cat(sprintf("Akurasi = %.3f, F1 = %.3f, AUC = %.3f\n", akurasi, f1, auc_knn))


# ---- Grafik ----
dk <- rbind(data.frame(k = daftar_k, akurasi = akurasi_cv, jenis = "LOOCV (training)"),
            data.frame(k = daftar_k, akurasi = akurasi_uji_k, jenis = "Test set"))
p1 <- ggplot(dk, aes(k, akurasi, colour = jenis)) +
  geom_vline(xintercept = k_best, linetype = "dashed", colour = warna$redup) +
  geom_line(linewidth = 0.9) +
  geom_point(size = 1.8) +
  annotate("text", x = k_best, y = min(dk$akurasi), label = paste0(" best k = ", k_best), hjust = 0, vjust = 0,
           colour = warna$teks, size = 3.1) +
  scale_colour_manual(values = c(pal[1], pal[2]), name = NULL) +
  scale_x_continuous(breaks = seq(1, 25, by = 4)) +
  labs(title = "Accuracy vs number of neighbours", x = "k", y = "Accuracy") +
  theme(legend.position = "bottom")
gx <- seq(min(d$connection_duration), max(d$connection_duration), length.out = 90)
gy <- seq(min(d$bytes_sent), max(d$bytes_sent), length.out = 90)
bidang <- expand.grid(connection_duration = gx, bytes_sent = gy)
bidang$x3 <- rerata["x3"]                           # fitur tambahan ditahan pada reratanya
xb <- scale(bidang[fitur], center = rerata, scale = sb)
pb <- class::knn(xl, xb, latih$kelas, k = k_best, prob = TRUE)
bidang$prob <- ifelse(pb == "Yes", attr(pb, "prob"), 1 - attr(pb, "prob"))
p2 <- ggplot() +
  geom_raster(data = bidang, aes(connection_duration, bytes_sent, fill = prob), alpha = 0.5) +
  geom_contour(data = bidang, aes(connection_duration, bytes_sent, z = prob), breaks = 0.5, colour = warna$teks, linewidth = 0.6) +
  geom_point(data = uji, aes(connection_duration, bytes_sent, colour = kelas, shape = kelas), size = 1.9) +
  scale_fill_gradient2(low = pal[1], mid = warna$panel, high = pal[2], midpoint = 0.5, guide = "none") +
  scale_colour_manual(values = c(No = pal[1], Yes = pal[2]), name = "anomalous_traffic") +
  scale_shape_manual(values = c(No = 16, Yes = 17), name = "anomalous_traffic") +
  coord_cartesian(expand = FALSE) +
  labs(title = sprintf("Decision regions, k = %d (test points)", k_best), subtitle = "Shading = share of Yes neighbours",
       x = "connection_duration", y = "bytes_sent")
dkf <- as.data.frame(konf)
dkf$persen <- dkf$Freq / sum(dkf$Freq)
dkf$benar <- dkf$Actual == dkf$Predicted
p3 <- ggplot(dkf, aes(Predicted, Actual)) +
  geom_tile(aes(fill = benar, alpha = persen), colour = warna$panel, linewidth = 1) +
  geom_text(aes(label = sprintf("%d\n(%.0f%%)", Freq, 100 * persen)), colour = warna$teks, size = 3.4, lineheight = 0.9) +
  scale_fill_manual(values = c(`TRUE` = pal[3], `FALSE` = pal[5]), guide = "none") +
  scale_alpha(range = c(0.25, 0.85), guide = "none") +
  scale_y_discrete(limits = c("Yes", "No")) +
  labs(title = "Confusion matrix (test data)", x = "Predicted", y = "Actual") +
  theme(panel.grid = element_blank())
p_hasil <- if (tata == 1) (p2 | (p1 / p3)) + plot_layout(widths = c(1.35, 1)) else (p2 / (p1 | p3)) + plot_layout(heights = c(1.3, 1))

print(p_hasil)

The project file you can download

The original project file is available. It is not just the picture above: you get the working R project. It can be downloaded after payment, and we send it by WhatsApp or email.

ZIP: analisis.R + data_contoh.csv + BACA-DULU.txt

What is inside the ZIP

The complete analysis script (analisis.R), commented step by step, ready to run in RStudio.
A sample dataset (data_contoh.csv) so the script runs straight away.
A short guide (BACA-DULU.txt): which packages to install, how to run it and how to swap in your own data.

Packages and prices

Choose how much help you need. Each higher package includes everything in the lower ones. Prices exclude 11% VAT.

Package 1

Code and Explanation

US$16

excl. 11% VAT

Duration: 3 working days

Output: R files + result figures

Deliverables

Fully commented R code (.R) for k-Nearest Neighbors
Example data and step-by-step run instructions
Ready-to-use result figures and metrics table
Short explanation of the method, its assumptions and how to read the results

Choose Package 1

Package 2 · most chosen

Your Data Analysis + Interpretation

US$47

excl. 11% VAT

Duration: 7 working days

Output: Code + analysis + interpretation notes

Includes all of Package 1, plus

Adapting the code to your own research dataset (CSV or Excel)
Assumption checks, result validation and data cleaning
Tables and figures formatted for your manuscript
Interpretation notes for the methods and discussion sections, for you to write up in your own words

Choose Package 2

Package 3

Full Guidance

US$100

excl. 11% VAT

Duration: 12-15 working days

Output: Code + analysis + guidance until ready to present

Includes all of Packages 1 & 2, plus

Comparison against one alternative method with the reasoning for the choice
Two 60-minute online coaching sessions so you fully understand the code and results
Revisions following your supervisor feedback (up to 3 rounds)
Practice Q&A to prepare for your seminar and defence
Full documentation (README, R package list (sessionInfo)) so the results can be reproduced

Choose Package 3

Payment: 50% down payment before work starts, balance after the deliverables are handed over
Tax: Prices exclude 11% VAT
Data and academic integrity: Results are computed from your own research data; you write and stand behind your manuscript, we help with the analysis and your understanding of it
Revisions: Up to 2 revisions are included in the price (Package 3: 3 rounds)

Frequently asked questions

Do I get the real project file?

Yes. The original project file is a ZIP containing the complete analisis.R script, a data_contoh.csv sample dataset and a BACA-DULU.txt guide. It can be downloaded after payment, and we send it by WhatsApp or email. For your own data (Package 2 and 3) the script is adapted to your dataset.

Is this suitable for a Undergraduate thesis (S1)?

Yes. k-Nearest Neighbors is commonly used at this level in Informatics and Information Systems. We adapt the analysis to your research question, your own data and your supervisor's requirements.

Is the result sheet real data?

No. The sheet is computed from illustrative synthetic data so you can see the kind of output R Studio gives. For your order we run the same method on your own data.

Will I understand the code?

That is the point of the packages. Every script is commented, and Package 3 includes two coaching sessions plus practice questions so you can explain the method and the results at your seminar and defence.

How is the price decided?

Each project has three packages: Package 1 (code and explanation) US$16, Package 2 (your data analysis and interpretation) US$47 and Package 3 (full guidance) US$100, excluding 11% VAT. Larger datasets, extra methods or tight deadlines adjust the quote after a short consultation.

Similar projects

See all

PreviousFactors causing parcel delivery delays for e-commerce in Greater Jakarta

NextClassifying Hypertension by Age and Body Mass Index with a Support Vector Machine

The result sheet uses illustrative synthetic data. R is a programming language of the R Foundation project; RStudio and Posit are trademarks of Posit PBC.

Back to R Studio portfolio

Memuat