## 📄 Dataset Description

This dataset supports the detection and prediction of cybersecurity threats based on user behavior and network traffic. It has been split into separate training and testing files for standardized evaluation.

Participants are expected to build models that identify whether a session is associated with an **intrusion attack** (`attack_detected = 1`) or normal activity (`attack_detected = 0`).

### 🔍 Files

- **`train.csv`**  
  Contains historical session data with all input features and the target label (`attack_detected`).  
  Use this file to train your machine learning models.

- **`test.csv`**  
  Contains session data **without** the target label.  
  Your goal is to predict the probability that each session in this file is an attack.

- **`sample_submission.csv`**  
  A template for your submission.  
  It includes all `session_id` values from the test set with placeholder predictions.  
  Format your submission to match this file:  
  ```
  session_id,attack_detected
  SID_00003,0.05
  SID_00007,0.91
  ...
  ```

---

### 📊 Columns (Features)

| Column Name             | Description |
|-------------------------|-------------|
| `session_id`            | Unique identifier for each session |
| `network_packet_size`   | Size of packets in bytes (64 to 1500) |
| `protocol_type`         | Protocol used: TCP, UDP, or ICMP |
| `login_attempts`        | Number of login attempts during the session |
| `session_duration`      | Duration of the session in seconds |
| `encryption_used`       | Encryption protocol used: AES, DES, or None |
| `ip_reputation_score`   | Score from 0 to 1 indicating IP trustworthiness (higher is more suspicious) |
| `failed_logins`         | Number of failed login attempts |
| `browser_type`          | Browser used by the user: Chrome, Firefox, Edge, Safari, or Unknown |
| `unusual_time_access`   | 1 if access happened at an unusual time (e.g. night hours), otherwise 0 |
| `attack_detected`       | **Target variable** (1 for attack, 0 for normal) – only in `train.csv` |

---

### 🧠 Prediction Task

Predict the likelihood that each session in the test set corresponds to a cyberattack. Your model should output a **probability** between 0 and 1 for each session.