Data Cleaning and Visualization Report Writing - IT Computer Science Assignment Help

Assignment Task

Task 

Scenario
WA Cyber Command – WACY-COM has acquired aggregate data about 200,000 identified cyber-attacks and scans. The data are sourced from a Honey-pot project which places fake servers across the globe and records attacker activity and techniques. As Honeypots are simulated networks and devices, they allow researchers to safely monitor malicious traffic without endangering real computers or networks. When analysing cyber-attacks, the level of sophistication of attackers can range in from low-level scammers, right up to Advanced Persistent Threats (APTs) which are often associated with state-sponsored cyber-attacks. The attacker tools and techniques generally vary depending on the sophistication of the attacker.
A research project has been undertaken by WACY-COM to determine what patterns exist in state-sponsored APT attacks. Typically, a complex attack can involve multiple attacking computers (with different source-IP addresses) and different payloads and targets. By coordinating attacks from multiple devices, the attacks can become more difficult to detect and stop. Note: The scenario and data are loosely based on real-world cyber threats and attacks. However, this data set has been curated entirely to help you understand the types of data, correlations and issues that you may experience when handling real-world cyber security data.

Data description
The aggregated data available to WACY-COM are described by the following features (with data types given in square brackets):
[Categorical] Port – The port or service that was being attacked on the honey-pot network. Well known ports include 80/443 (Web traffic), 25 (Email reception), 993
(Email collection)
[Categorical] Protocol – The Internet Protocol in use to conduct the attack
[Numeric] Hits – How many ‘hits’ the attacker made against the network
[Numeric] Average Request Size (Bytes) – Average ‘payload’ sent by the attacker
[Numeric] Attack Window (Seconds) – Duration of the attack
[Numeric] Average Attacker Payload Entropy (Bits) – An attempt to qualify whether payload data were encrypted (higher Shannon entropy may indicate random data, data obfuscation or encryption)
[Categorical] Target Honeypot Server OS – The Operating System of the simulated server
[Numeric] Attack Source IP Address Count – How many unique IP addresses were used in the attack

Objectives
You have been brought on as part of a data analysis team to determine if APT activity can be inferred from other attack parameters. Your initial goals will be to

•  Clean and prepare the data for data exploration and basic data analysis.
•  Visualise the data using Principal Component Analysis (PCA).
•  Identify features that may be useful for ML algorithms
•  Create a brief report that will describe whether a subset of features could be used to detect APT activity.

Task
First, copy the code below to a R script. Enter your student ID into the command set.seed(.) and run the whole code. The code will create a sub-sample that is unique to you.
#You may need to change/include the path of your working directory #Import the dataset into R Studio.
dat <- read.csv("ML_dataset.csv", na.strings=NA, stringsAsFactors=TRUE)
set.seed(Enter your student ID here)

#Randomly select 500 rows
selected.rows <- sample(1:nrow(dat),size=500,replace=FALSE)
#Your sub-sample of 500 observations
mydata <- dat[selected.rows,]
dim(mydata) #check the dimension of your sub-sample
You are to clean and perform basic data analysis on the relevant features in mydata, and as well as principal component analysis (PCA). This is to be done using “R”. You will report on your findings.

(iii)Examine the results in sub-parts (i) and (ii). Are there any invalid categories/values for the categorical variables? If so, how will you deal with them and why? Is there any  evidence of outliers for any of the continuous/numeric variables? If so, how many and what percentage are there and how will you deal with them? Justify your decision in the treatment of outliers (if any).

Part 2 – Perform PCA and Visualise Data

(i) Clean your data as you have suggested in Part 1 (iii) to make it usable in “R”. However, do not remove the incomplete cases at this point.
(ii) Export your “cleaned” data as follows. This file will need to be submitted along with you report.

#Write to a csv file.
write.csv(mydata,"mydata.csv")
** Do not read the data back in and use them for PCA **

(iii) Extract only the data for the numeric features in mydata, along with APT, and store them as a data frame/tibble. Then, remove the incomplete cases and perform PCA using prcomp(.) in R, but only on the numeric features.
- Outline why you believe the data should or should not be scaled, i.e.standardised, when performing PCA.
- Outline the individual and cumulative proportions of variance (3 decimalplaces) explained by each of the first 4 components.
- Outline how many principal components are adequate to explain at least 50%of the variability in your data.
- Outline the coefficients (or loadings) to 3 decimal places for PC1, PC2 and PC3, and describe which features (based on the loadings) are the key drivers for each of these three PCs.

(iv) Create a biplot for 1) PC1 vs PC2, 2) PC1 vs PC3 and 3) PC2 vs PC3, to help visualise the results of your PCA in the first three dimensions. Colour code the points with the variable APT. Write a paragraph to explain what each of your biplots are showing.
That is, comment on the PCA plot, the loading plot individually, and then both plots combined (see Slides 28-29 of Module 3 notes) and outline and justify which (if any) of the features can help to distinguish APT activity.

(v) Based on the results from parts (iii) to (v), describe
-Which dimension (choose one) can assist with the classification of APT (Hint:project all the points in the PCA plot to PC1 axis and see whether there is good separation between the points for known and unknown APT actors. Then project to PC2 axis and see if there is separation between APT and non-APT, and whether it is better than the projection to PC1, then likewise with PC3).
-The key features in this dimension that can drive this process (Hint: based on your decision above, examine the loadings from part (iii) of your chosen PC and choose those whose absolute loading (i.e. disregard the sign) is greater than 0.3).

This IT Computer Science Assignment has been solved by our IT Computer Science Assignment Expert at My Uni Paper. Our Assignment Writing Experts are efficient to provide a fresh solution to this question. We are serving more than 10000+ Students in Australia, UK & US by helping them to score HD in their academics. Our Experts are well trained to follow all marking rubrics & referencing Style. Be it a used or new solution, the quality of the work submitted by our assignment experts remains unhampered. 

You may continue to expect the same or even better quality with the used and new assignment solution files respectively. There’s one thing to be noticed that you could choose one between the two and acquire an HD either way. You could choose a new assignment solution file to get yourself an exclusive, plagiarism (with free Turn tin file), expert quality assignment or order an old solution file that was considered worthy of the highest distinction.