Lion Cipher Lab
Classify network traffic with a decision tree
- AI Security
- Intermediate
- ~55 min
- Free · no account required
Why it matters
Every network generates a flood of connection records -- who talked to whom, for how long, how many bytes, how many failed logins -- and buried in that flood are the few flows that are an attack. Intrusion detection is the job of separating the two, and it is a textbook classification problem: given the measurements of one flow, output benign or malicious. Machine learning can learn that boundary from labeled examples, which is why it now sits inside real detection tooling. But in security you cannot treat a detector as a magic box that emits verdicts. When your model flags a flow and you cut…
What you'll learn
- what a labeled dataset is: rows of features with a known-correct label attached
- framing intrusion detection as a classification problem: benign flow vs malicious flow
- generating a small labeled network-flow dataset locally so you are never blocked waiting on a download
- loading a CSV into pandas and separating the features (X) from the label (y)
- a train/test split and why the model must be graded on flows it never trained on
- training a scikit-learn DecisionTreeClassifier to tell benign from malicious
- evaluating with accuracy, a confusion matrix, and precision and recall PER CLASS
- why recall on the malicious class is the number a defender lives and dies by (a missed attack is a breach)
- visualizing the tree with plot_tree and reading it as a human-readable flowchart of the detection logic
- reading feature_importances_ to see which flow features actually drive detection
Steps in this lab
- The problem: benign flow or malicious flow
- The words you need: dataset, feature, label, and why a tree
- Install scikit-learn, pandas, and matplotlib
- Get a labeled dataset (generate one so you are never blocked)
- Load the data and split it into train and test
- Train the decision tree
- Evaluate like a defender: precision, recall, confusion matrix
- Visualize the tree: read the detection logic as a flowchart
- The honest limits: a teaching model, not a production IDS
- What you can now do that most people can't