<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Network Anomalies with ML — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-network-anomalies-with-ml.

## Tools

### `zeek`

Network log generation for ML feature extraction

**Usage:**
```bash
zeek -r capture.pcap
```

**Key Flags:**
  - `-r: read PCAP`
  - `-C: disable checksum validation`
  - Produces conn.log, dns.log, http.log

---

### `zeek-cut`

Field extraction from Zeek logs

**Usage:**
```bash
zeek-cut -d ts id.orig_h id.resp_h orig_bytes < conn.log
```

**Key Flags:**
  - `-d: convert timestamps`
  - Field names as positional arguments`

---

### `scikit-learn`

Python ML library for anomaly detection

**Usage:**
```python
from sklearn.ensemble import IsolationForest
model = IsolationForest(contamination=0.05)
model.fit(features)
```

**Key Classes:**
  - `IsolationForest: unsupervised anomaly detection`
  - `DBSCAN: density-based clustering`
  - `StandardScaler: feature normalization`

---

### `pandas`

Data manipulation for feature engineering

**Usage:**
```python
import pandas as pd
df = pd.read_csv("conn.log", sep="\t", comment="#")
```

**Key Methods:**
  - `groupby().agg(): aggregate features`
  - `resample(): time-series windowing`
  - `rolling(): moving statistics`

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
