@masterthesis{Bergmann2021, type = {Bachelor Thesis}, author = {Bergmann, Max}, title = {A machine learning approach for churn prediction within the social network Jodel}, doi = {10.26127/BTUOpen-6087}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-60878}, school = {BTU Cottbus - Senftenberg}, year = {2021}, abstract = {Within the last decades, the number of social networks is growing fast. The competition of retaining the customers to grow their platform and increase their profitability is rising. That is why companies need to detect possible churners to retain these. The problem of predicting the users' lifetime, churning users, and the reasons for churning can be tackled by using machine learning. The goal of this bachelor thesis is to build machine learning models to predict user churn and the user lifetime within the social network Jodel, a location-based anonymous messaging application for Android and iOS. To get the best possible prediction results, we have started with extensive literature research, whose approaches we have tested and added to a machine learning pipeline to build predictive models. With these models, we have investigated the performance after different observation time windows and have finally compared the strongest models to detect similarities and understand the insights to learn their behaviour. The results of this thesis are machine learning models for a selected representative set of communities varying in size within the Kingdom of Saudi Arabia and a country model leveraging all data. These models are used for a regression task by predicting the lifetime of a user and a multi-label classification of a user into six different churn classes. Additionally, we have also given models for a binary classification, where the model will predict if the user will churn within a given time or not. These models have shown general strong predictive power, which is shrinking when limiting the observation time window. Especially the binary classification yielded high accuracy of over 99\%. The best models have been used for predicting user churn within other communities to detect communities with possible similar behaviour. These similarities then have been determined by features' importance, where the most important features have got fed back into empirics. This has shown statistically significant differences between user groups with a different active time but as of today no clear trends were visible that had led us to define the communities' behaviours. Since the competition of social networks is still growing, the retaining of users will stay a core marketing strategy, which will need to be tackled by machine learning and artificial intelligence. The created models could be useful for predicting churning users within the platform Jodel to detect these customers that will churn within a given time. Researches did not focus much on anonymous and location-based messaging. That is why the results of this thesis on the anonymous messaging application Jodel opens a variety of possible tasks for the future in this context.}, subject = {Machine learning; Churn prediction; Neural networks; Python; Feature engineering; Maschinelles Lernen; Online-Community; Prognose; Maschinelles Lernen; Abwanderungsvorhersage; Neuronale Netze; Klassifizierungsb{\"a}ume; Regressionsb{\"a}ume}, language = {en} } @phdthesis{Rietz2017, author = {Rietz, Ren{\´e}}, title = {Optimization of network intrusion detection processes}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-44327}, school = {BTU Cottbus - Senftenberg}, year = {2017}, abstract = {Intrusion detection is a concept from the field of IT security. Network intrusion detection systems (NIDS) are used in addition to preventative measures, such as firewalls, to enable an automated detection of attacks. Network security threats often consist of multiple attack phases directed against various components of the network. During each attack phase, varying types of security-related events can be observed at various points in the network. Security monitoring, however, is nowadays essentially limited to the uplink to the internet. Sometimes it is also used to a limited extent at key points within a network, but the analysis methods do not have the same depth as at the uplink. Other areas, such as virtual networks in virtual machines (VMs), are not covered at all, yet. The aim of this thesis has been to improve the detection capability of attacks in local area networks. With a glance at the area of safety engineering, it appears efficient to secure these networks thoroughly and to develop additional monitoring solutions only for the remaining problem cases. This entails several challenges for the analysis of different parts of the TCP/IP stack. The lowermost part of the network stack has to be analyzed for attacks on network components, such as switches and VM bridges. For this, there is still no technology. Although attacks on the layers~2 and 3, such as ARP spoofing and rogue DHCP servers in physical networks, can be controlled to some extent by appropriate switches, equivalent methods are not used in virtual networks. Therefore, a software-defined networking based approach is proposed to counteract the respective attacks, which works for physical and virtual networks. The upper layers are already largely covered by traditional NIDS methods, but the rapidly increasing data rates of local area networks often lead to an uncontrolled discarding of traffic due to overload situations in the monitoring stations. Therefore, the drawbacks of current optimization approaches are outlined based on a detailed performance profiling of typical intrusion detection systems. A new approach for parallelizing the intrusion detection analysis that copes with the increasing network dynamics is introduced and evaluated. Since further special issues for NIDS particularly go back to the massive use of web technologies in today's networks, a firewall architecture is presented which applies novel NIDS methods based on machine learning to identify web applications and to ward off malicious inputs. The architecture addresses the entire process chain starting from the data transfer with HTTP via the analysis of manipulated web documents to the extraction and analysis of active contents.}, subject = {Intrusion Detection Systems (NIDS); Software-Defined Networking (SDN); Parallel NIDS; Web Firewall (Web 2.0); Machine Learning; Einbrucherkennungssysteme (IDS); Software-definierte Netzwerke (SDN); Web Firewall; Web 2.0; Maschinelles Lernen; Eindringerkennung; Maschinelles Lernen; Software-defined networking; World Wide Web 2.0; Firewall}, language = {en} }