ML Network Security Project

Abstract

1. Introduction

This project tackles phishing website detection as a binary classification problem. It takes 30 URL/domain/content features extracted from websites and predicts whether a site is legitimate (1) or phishing (0).

Instead of a monolithic Jupyter notebook approach, the entire ML lifecycle is decomposed into modular, versioned pipeline stages with proper artifact management, experiment tracking, and serving infrastructure.

2. Objective

End-to-end MLOps pipeline for phishing website detection using scikit-learn, MLflow, FastAPI, and MongoDB Atlas.

This project demonstrates how Python can be applied to a real-world Cybersecurity & Ethical Hacking problem.

3. Key Features / Modules

• Automated 4-Stage Pipeline: Data flows from MongoDB through ingestion, validation, transformation, and model training without manual intervention.
• Multi-Model Evaluation: 5 classifiers (Logistic Regression, Decision Tree, Random Forest, Gradient Boosting, AdaBoost) are trained and compared via GridSearchCV.
• Experiment Tracking: Every training run logs metrics (F1, precision, recall) and model artifacts to MLflow via DagsHub.
• Data Drift Detection: Kolmogorov-Smirnov statistical tests automatically flag distribution shifts between train and test sets.
• REST API Serving: Upload a CSV and get predictions rendered as an HTML table, or trigger retraining on demand.
• Cloud-Ready: Dockerfile, S3 artifact sync, and a GitHub Actions CI/CD pipeline (ECR + ECS) are included.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Python 3.8 or later
• pip / virtualenv for dependencies
• VS Code, PyCharm or Jupyter Notebook
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/rakheOmar/ml-network-security-project.git
cd ml-network-security-project

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by rakheOmar and published on GitHub under the MIT License. Please follow the license terms and credit the original author when you use or modify this code.