Answers.Body: <p>It seems that you want to detect <em>ranges</em> of IP addresses that are vulnerable/dangerous/etc, right? Such ranges are essentially numeric intervals, and so my suggestion is to look at <a href="https://en.wikipedia.org/wiki/Decision_tree_learning" rel="nofollow noreferrer">decision tree learning</a> instead of neural networks, because you are essentially doing a classification task where you want to test both categorical data and splits over numerical attributes.</p>
  
  <p>The result will be a tree-like function (nested conditionals) of the form</p>
  
  <pre><code>IF ...&gt; address &gt; ... 
     THEN [vulnerable]
     ELSE IF port=... 
                THEN [not vulnerable]
                ELSE [vulnerable]
  </code></pre>
  
  <p>where a huge benefit is that it is also more human-readable than a neural net.</p>
  
  <p>The most prominent algorithms for decision trees are <a href="https://en.wikipedia.org/wiki/ID3_algorithm" rel="nofollow noreferrer">ID 3</a> and its successor <a href="https://en.wikipedia.org/wiki/C4.5_algorithm" rel="nofollow noreferrer">C4.5</a>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-16T04:52:03.810Z
Answers.Text: I have the data sets of couputers that is purely of the type (ip, vulnerability). I know which devices are vulnerable. I just want to detect a pattern to the occurrence of these vulnerable computers.
Answers.UserDisplayName: Uzair Ahmed
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-16T17:53:37.330Z
Answers.Text: Could you please state more specifically what you mean by a "pattern"? What would be the desired outcome of the learning process? Could you perhaps give a small example?
Answers.UserDisplayName: Jens Classen
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-17T18:04:35.947Z
Answers.Text: After the learning process, I want it to give a general rule as to where in an network do the vulnerabilities occur with reference to thier IPs.
Answers.UserDisplayName: Uzair Ahmed
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-19T18:40:48.040Z
Answers.Text: So the goal is to learn a mapping {IP addresses} -> {vulnerabilities}. Learning always involves some form of generalization or abstraction. In which direction should this happen? Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X" or the other way round, i.e. "addresses that have vulnerabilities X and Y often also have Z"?
Answers.UserDisplayName: Jens Classen
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-21T17:38:27.320Z
Answers.Text: the first type i.e. Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X.
Answers.UserDisplayName: Uzair Ahmed
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-23T21:11:51.623Z
Answers.Text: Then the next question is what kind of structure you are able to exploit. In order for learning to happen, there has to be some way to _generalize_, meaning we have to be able to say that address D is in some sense similar/related/close to A,B,C. If all we have is the addresses themselves, all I can think of is treating them as numbers and assuming numbers close to each other are in a way "similar". This makes sense to a certain degree, namely when a group of addresses with the same prefix belong to the same subnet, and this is why I suggest attempting to learn address _ranges_ (=intervals).
Answers.UserDisplayName: Jens Classen
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-25T04:26:03.773Z
Answers.Text: That is exactly what I had in mind.
Answers.UserDisplayName: Uzair Ahmed
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-15T02:39:27.517Z
Answers.LastActivityDate: 2019-08-15T02:39:27.517Z
Answers.UserDisplayName: Jens Classen
Body: <p>How to detect patterns in a data set of given IP addresses using a neural network?</p>
  
  <p>The data set is actually a list of all the vulnerable devices on a network. I want to use a neural network that detctes any patters in the occurrences of these vulnerabilities with reference to their IPs and ports.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-07-31T13:28:58.193Z
Comments.Text: is your dataset purely (ip, vulenerable) pairs or is there more, like a temporal aspect, etc
Comments.UserDisplayName: mshlis
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-08-16T04:48:41.717Z
Comments.Text: @mshlis the data set is purely (ip, vulnerable) pairs.
Comments.UserDisplayName: Uzair Ahmed
Tags: <neural-networks><deep-learning><pattern-recognition>
Title: How to detect patterns in a data set of given IP addresses using a neural network?
UserDisplayName: Uzair Ahmed
ThreadText: # How to detect patterns in a data set of given IP addresses using a neural network?
  
  (Asked by: username_0 on 2019-07-31)
  
  How to detect patterns in a data set of given IP addresses using a neural network?
  
  The data set is actually a list of all the vulnerable devices on a network. I want to use a neural network that detctes any patters in the occurrences of these vulnerabilities with reference to their IPs and ports.
  
  **Tags:** neural-networks, deep-learning, pattern-recognition
  > **Comments:**
  > **username_1**: is your dataset purely (ip, vulenerable) pairs or is there more, like a temporal aspect, etc  
  > **username_0**: @mshlis the data set is purely (ip, vulnerable) pairs.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2019-08-15. Score: 1
  
  It seems that you want to detect ranges of IP addresses that are vulnerable/dangerous/etc, right? Such ranges are essentially numeric intervals, and so my suggestion is to look at decision tree learning instead of neural networks, because you are essentially doing a classification task where you want to test both categorical data and splits over numerical attributes.
  The result will be a tree-like function (nested conditionals) of the form
  IF ...> address > ... 
     THEN [vulnerable]
     ELSE IF port=... 
                THEN [not vulnerable]
                ELSE [vulnerable]
  
  where a huge benefit is that it is also more human-readable than a neural net.
  The most prominent algorithms for decision trees are ID 3 and its successor C4.5.
  
  > **Comments:**
  > **username_0**: I have the data sets of couputers that is purely of the type (ip, vulnerability). I know which devices are vulnerable. I just want to detect a pattern to the occurrence of these vulnerable computers.  
  > **username_2**: Could you please state more specifically what you mean by a "pattern"? What would be the desired outcome of the learning process? Could you perhaps give a small example?  
  > **username_0**: After the learning process, I want it to give a general rule as to where in an network do the vulnerabilities occur with reference to thier IPs.  
  > **username_2**: So the goal is to learn a mapping {IP addresses} -> {vulnerabilities}. Learning always involves some form of generalization or abstraction. In which direction should this happen? Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X" or the other way round, i.e. "addresses that have vulnerabilities X and Y often also have Z"?  
  > **username_0**: the first type i.e. Is it "since addresses A,B,C have vulnerability X, neighbouring address D likely also has X.  
  > **username_2**: Then the next question is what kind of structure you are able to exploit. In order for learning to happen, there has to be some way to _generalize_, meaning we have to be able to say that address D is in some sense similar/related/close to A,B,C. If all we have is the addresses themselves, all I can think of is treating them as numbers and assuming numbers close to each other are in a way "similar". This makes sense to a certain degree, namely when a group of addresses with the same prefix belong to the same subnet, and this is why I suggest attempting to learn address _ranges_ (=intervals).  
  > **username_0**: That is exactly what I had in mind.  
  
  ---
  
  