About & Methodology

CyberShield is a browser-based dashboard that explores network-flow records from UNSW-NB15. It is a standalone web app — it is not Microsoft Power BI and not a PBIX file. It complements the separate report, presentation and DAX guide in the starter pack.

• Dataset: UNSW-NB15 — official training split (UNSW_NB15_training-set.csv)
• Hosted at: https://huggingface.co/datasets/Mouwiya/UNSW-NB15
• Citation: Moustafa, N. & Slay, J. (2015). UNSW-NB15: a comprehensive data set for network intrusion detection systems. MilCIS 2015.
• Status: idle
• Verified label values: — (0 = normal, 1 = attack; cross-checked against attack_cat = "Normal")

1. On page load the official training CSV (~32 MB) is downloaded directly from Hugging Face; if the browser is blocked, a server-side fallback streams the same file.
2. The CSV is parsed in chunks; the header is checked for every required column before any chart renders.
3. The loaded row count is checked (must be ≥ 80,000; official split is 175,341).
4. All KPIs and charts are computed in the browser from the loaded rows — nothing is pre-computed or invented.
5. Filters (label, attack_cat, proto, service, search) apply to every page; CSV exports reflect the current filter.

• Research dataset generated in 2015 in a lab (IXIA PerfectStorm) — not live monitoring and not current threat data.
• Only the training split is loaded; the testing split (82,332 rows) is not included.
• The training split is intentionally attack-heavy (~68% attacks), so it does not reflect real-world traffic ratios.
• Only 13 of the 45 columns are kept in memory to stay responsive; others are not visualised.
• Data relies on a third-party Hugging Face mirror being available; if it goes offline, the dashboard shows an error instead of figures.