🚨 Network Intrusion Detection System (IDS)

A Machine Learning-based Network Intrusion Detection System that analyzes network traffic from Wireshark PCAP/CSV files and detects suspicious activities using behavioral features.

---

📌 Project Overview

With the rapid growth of computer networks, detecting malicious activities such as unauthorized access, port scanning, and denial-of-service attacks has become critical.

This project implements a complete IDS pipeline:

• Extracts features from network traffic
• Performs feature engineering
• Uses Machine Learning for classification
• Deploys a web API using FastAPI for real-time analysis

---

⚙️ Features

• 📂 Upload Wireshark PCAP / CSV files
• 🧠 ML-based intrusion detection
• ⚡ High-performance backend using FastAPI
• 📊 Traffic analysis summary
• 🚨 Detection of suspicious patterns

---

🧠 Machine Learning Models Used

• Logistic Regression
• Random Forest (Best performing)
• Naive Bayes
• K-Nearest Neighbors (KNN)

📊 Evaluation Metrics

• Accuracy
• Precision
• Recall
• F1 Score
• Confusion Matrix

---

📊 Feature Engineering

The following features are extracted:

• Protocol type
• Packet length
• Packet rate per IP
• Mean packet size
• SYN packet count
• Connection frequency
• Flow duration

These features capture behavioral patterns of network traffic.

---

🚀 Backend (FastAPI)

The system uses FastAPI for high-speed API development.

Key functionalities:

• Accept file uploads (PCAP/CSV)
• Process traffic data
• Apply ML model
• Return analysis results

---

🛠️ Tech Stack

• Python
• Pandas, NumPy
• Scikit-learn
• FastAPI
• Scapy (PCAP parsing)
• Uvicorn (server)
• Chart.js / Bootstrap (frontend)

---

📂 Project Structure

IDS_Web_App/ │ ├── main.py # FastAPI backend ├── model.pkl # Trained ML model ├── templates/ # HTML files ├── static/ # CSS/JS ├── README.md

🚀 How to Run

1️⃣ Clone Repository

git clone https://github.com/your-username/your-repo-name.git
cd your-repo-name

2️⃣ Install Dependencies

Optional frontend env:

• VITE_BACKEND_URL (default used in code: http://localhost:8000)
• AWS deployment steps: deploy/aws/README.md

For the ML backend, place the trained model at backend/model/model.pkl before starting the API.

pip install fastapi uvicorn pandas scikit-learn scapy joblib

3️⃣ Run Server

uvicorn main:app --reload

4️⃣ Open in Browser

http://127.0.0.1:8000

---

🧪 Input

• PCAP files (Wireshark)
• CSV traffic datasets

---

📈 Output

• Traffic classification:

  • Normal (0)
  • Suspicious (1)

• Summary including:

  • Packet statistics
  • Suspicious traffic count
  • Top attacking IPs

---

🎯 Future Scope

• Real-time network monitoring
• Deep learning-based detection
• Cloud deployment (AWS / GCP)
• Advanced threat categorization

---

👥 Team Members

• Avisya Venkatachalam
• Madhuvanthi
• Bojja Divya

---

📌 Conclusion

This project demonstrates a complete intrusion detection system combining networking, machine learning, and modern web APIs to detect suspicious network activity efficiently.