AI-Powered Network Intrusion Detection System (IDS)

Live demo — the alert dashboard

This simulates the front-end your real IDS would show. Press Start monitoring to stream synthetic traffic. An anomaly-scoring routine flags suspicious flows the way an Isolation Forest model would. No real network data is used — it is safe to run anywhere.

Speed

Flows analysed

Threat alerts

0/min

Alert rate

Idle

Monitor status

Traffic volume (last 24 windows)

Normal window Window with alert

Alert breakdown by type

Live flow feed

Recent network flows with anomaly score and verdict
Time	Source → Dest	Proto	Bytes	Score	Verdict
Press “Start monitoring” to begin.

Overview — what you are building and why

An Intrusion Detection System watches network traffic and raises alarms when it sees something that does not look like normal behaviour: a port scan, a sudden flood of connections, an unusual data transfer, or traffic to a known-bad host.

Traditional IDS tools rely on fixed signatures (known attack patterns). This project adds an AI / anomaly-detection layer: instead of only matching known attacks, the model learns a statistical picture of "normal" for your network and flags whatever deviates — so it can catch novel activity too.

Key features

Packet capture & feature extraction in Python (Scapy / pyshark).
An unsupervised Isolation Forest (or supervised Random Forest) model via scikit-learn.
A real-time, accessible dashboard for alerts and visualisations (the demo above).
Everything tested inside an isolated virtual lab — never on a live/shared network.

Architecture — how the pieces connect

1 · CaptureScapy/pyshark sniff packets on a lab interface

2 · FeaturesGroup packets into flows; compute bytes, duration, ports, rate

3 · Modelscikit-learn scores each flow: normal vs anomalous

4 · Alert APIFlask/FastAPI stores alerts; pushes to the UI

5 · DashboardBrowser UI shows charts, feed & alerts

Data flows one direction: raw packets in on the left, human-readable alerts out on the right. The dashboard you saw above is stage 5; stages 1–4 are the Python backend you build next.

Recommended stack

Layer	Tooling	Why
Capture	Scapy, or pyshark (Wireshark's tshark)	Pure-Python packet sniffing; pyshark is easier for beginners
Features	pandas, NumPy	Turn packets into per-flow rows the model can read
Model	scikit-learn (IsolationForest / RandomForest)	Battle-tested, easy to train and explain
Backend/API	Flask or FastAPI + SQLite	Serve alerts to the dashboard; store history
Dashboard	HTML/CSS/JS (like this page) + Chart.js optional	Accessible, framework-free, easy to host
Live updates	WebSocket or Server-Sent Events (SSE)	Push new alerts without page refresh

Build plan — step by step

Stand up a safe lab. Two VMs (e.g. VirtualBox): one "victim/normal" host, one "attacker" (Kali). Put them on a host-only network so nothing leaves your machine. See the Safe lab section.

Capture baseline traffic. Run normal activity (web browsing, file copies) and record packets with Scapy/pyshark to a .pcap. This is your "normal" training data.

Engineer flow features. Aggregate packets into flows keyed by (src IP, dst IP, dst port, protocol). For each flow compute: total bytes, packet count, duration, average packet size, and connections-per-second.

Train the model. Fit an IsolationForest on the normal flows. It learns the shape of normal and returns an anomaly score for any new flow. (See the ML section for code.)

Generate attacks & test. From the attacker VM run nmap scans, a SYN flood, or brute-force logins. Confirm the model scores these flows as anomalies while leaving normal traffic alone. Measure precision/recall.

Wire up alerts + dashboard. When a flow's score crosses a threshold, write an alert row and push it to the browser via SSE/WebSocket. The front-end (this page's code) renders the feed, charts, and counters.

Tune & document. Adjust the threshold to balance false alarms vs missed attacks, then write up your method, results, and a confusion matrix.

The machine-learning model

Isolation Forest (start here)

Unsupervised — needs only normal traffic to train. It "isolates" unusual points quickly, which makes them easy to flag. Great when you don't have labelled attack data.

from sklearn.ensemble import IsolationForest
import pandas as pd

# rows = one flow each; columns = engineered features
X = pd.read_csv("normal_flows.csv")

model = IsolationForest(
    n_estimators=200,
    contamination=0.02,   # ~2% expected anomalies
    random_state=42,
)
model.fit(X)

# score new traffic: -1 = anomaly, 1 = normal
pred  = model.predict(X_new)
score = -model.score_samples(X_new)  # higher = more suspicious

Random Forest (next step)

Supervised — needs both normal and labelled attack flows, but is more precise and tells you why (feature importances). A good "version 2" once you can generate labelled attacks in the lab.

Label each captured flow as normal or attack.
Split train/test, fit RandomForestClassifier.
Report accuracy, precision, recall, F1, and a confusion matrix.
Use feature_importances_ to explain what drives detections.

Tip: public datasets like NSL-KDD or CICIDS2017 give you labelled attack traffic to practise on before capturing your own.

Safe virtual-lab setup

Rule zero: only capture and attack traffic on machines you own, inside an isolated network. Never sniff or scan a school, home, or public network you don't have written permission to test. Keep the lab on a host-only or internal virtual network with no path to the internet.

Hypervisor: VirtualBox or VMware (free).
VM A — target/normal host: a light Linux (Ubuntu) generating everyday traffic.
VM B — attacker: Kali Linux with nmap, hping3, hydra.
Networking mode: Host-only adapter so traffic stays on your machine.
Run your Python capture on VM A (or a third "sensor" VM) watching the shared adapter.

Learning outcomes

Networking

Packets, flows, protocols, ports

Statistics

Distributions, thresholds, false positives

Applied AI/ML

Training, scoring, evaluation metrics

Anomaly detection

Modelling "normal", catching outliers