Network Intrusion Detection System

Advanced AI-powered network security monitoring with real-time threat detection using machine learning

Live Demo Get Started
SYSTEM SECURE

Key Features

Live Packet Capturing

Real-time monitoring of network traffic with advanced packet analysis and filtering capabilities.

AI Threat Detection

Machine learning-powered threat prediction using Random Forest algorithm for accurate anomaly detection.

High Performance

Optimized processing pipeline ensures minimal false positives and real-time response capabilities.

Analytics Dashboard

Comprehensive visualization of network traffic patterns and threat analysis with interactive charts.

Security Focused

Built with security in mind, providing detailed threat analysis and recommended security measures.

Easy Integration

Simple setup process with comprehensive documentation for seamless integration into existing systems.

About the Project

Project Overview

This Network Intrusion Detection System is designed for live monitoring of personal networks. It captures network packets from the user's PC and analyzes them to predict potential threats using a trained machine learning model. The system provides real-time threat detection with detailed analysis and recommendations.

System Architecture

The system follows a three-tier architecture with clear separation of concerns:

Frontend (HTML/CSS/JS)

User interface for real-time monitoring and visualization

↔

Backend (Node.js)

REST API server handling requests and Python script execution

↔

ML Engine (Python)

Packet capture, feature extraction, and threat prediction

Backend-Frontend Connection

The system uses a RESTful API architecture for seamless communication:

  • API Endpoint: GET /run-python - Triggers network analysis
  • Data Format: JSON responses with packet data and predictions
  • Real-time Updates: Frontend polls backend for live data
  • Error Handling: Comprehensive error management and user feedback
  • CORS Support: Cross-origin requests enabled for development

Technologies Used

Python
Scikit-Learn
Scapy/PyShark
Node.js
HTML5
CSS3
JavaScript

Model Training

The Random Forest model is trained using labeled network traffic data to classify network packets as benign, malicious, or outlier. The model provides detailed feature importance analysis and threat explanations, enabling accurate detection of various attack patterns and anomalies.

Machine Learning Pipeline

Data Collection

Capture network packets

→

Preprocessing

Extract features

→

ML Model

Random Forest

→

Prediction

Threat analysis

Installation Guide

1

Clone Repository

git clone https://github.com/abdulsalam401/NID-System.git
Contact developers for product access and queries
2

Download Trained Model

Download the pre-trained model from Google Drive and place it in the models folder:

https://drive.google.com/file/d/1-1p9dGLb2w-RIQ1iuAgGoj0MtJdZX7ht/view?usp=sharing
3

Create Virtual Environment

python -m venv venv

Activate Virtual Environment

venv\Scripts\activate
4

Install Dependencies

pip install -r requirements.txt
5

Start Backend Server

cd back-end && node server.js
6

Start Packet Capture

cd scripts && python runner.py

Launch Frontend

Open front-end/index.html in your browser and click "Analyze Network"

Security Operations Center (SOC) Live Monitor

Real-Time Flow Telemetry • Hybrid Random Forest Classifier • Automated Incident Response

Live SOC Engine: Active
Sensors: 1 (Autonomous Live Stream)
Threat Status: NORMAL
Intelligence: Hybrid RF + CIC-IDS2017
Real-Time Attack Simulation Launchpad
Interactive SOC Testing

Trigger real-world attack vectors against the telemetry stream and observe the hybrid AI and signature engine classify, alert, and generate mitigation rules in real time:

0

Packets Processed

0

Threats Flagged

100%

Security Posture Score

1

Active Defense Blocks

Global Cyber Threat Vectors & Trajectory Radar
PROTECTED NODEDMZ Web-01 (192.168.1.10)
ACTIVE THREAT ARCSReady
LATEST INTRUSION ORIGINGlobal Sensor Network
Flow Velocity Oscilloscope (PPS & KB/s)
12 PPS • 8.4 KB/s
Traffic Protocol & Threat Ratio
94% Clean
HTTPS (62%)
TCP (24%)
DNS (9%)
Threats (5%)
SOAR Automated Incident Response Playbook
STANDBY • CONTINUOUS MONITORING
1. Flow IngestionStream Reassembled
2. AI ScoringRF + Heuristics
3
3. Threat IntelMITRE & IP Scoring
4
4. Hardeningiptables Auto-Drop
5
5. SIEM TicketingIncident Dispatched
MITRE ATT&CK® Threat Distribution
Enterprise Framework Mapping
T1498
Network DoS
0
T1046
Service Scanning
0
T1110
Brute Force
0
T1190
App Exploit
0
T1071
App Layer C2
0
Real-Time Network Packet & Flow Stream
Timestamp Source Destination Proto Bytes In Duration MITRE ATT&CK Threat Level Action
Initializing Live Packet Ingestion Stream...
AI Threat Classification & Forensic Explanations
Automated Incident Response & Firewall Hardening
Active Defense

Generated production-grade containment commands for currently detected and blocked malicious IP addresses:

Meet the Developers

Abdul

Abdul Salam

Security Analyst & Developer

+92 3011909963
abdulsalam.cyber1@gmail.com
github.com/abdulsalam401
abdul-salam-39467a274
abdul-salam-portfolio
Cybersecurity Network Analysis Python Machine Learning Threat Detection
Download Resume