A Python-based Network Intrusion Detection System that monitors network traffic, detects suspicious activity, and provides real-time security monitoring through an interactive GUI dashboard.
Mini IDS is a multi-threaded intrusion detection system built for a Computer Networks course project. It captures and analyzes live network packets (or simulated/PCAP data), detects five categories of attacks in real time, and generates security logs and HTML reports through a Tkinter dashboard.
- Real-time packet monitoring
- Port scan detection
- SYN flood detection
- SSH/RDP brute-force detection
- Suspicious IP detection using blacklist
- Payload anomaly detection
- Live packet stream dashboard
- Threat alerts with severity classification
- Automatic IP blocking for high-severity threats
- Security log generation (TXT & CSV)
- HTML report generation
- Simulation mode, live packet capture mode, and PCAP file analysis mode
| Layer | Technology |
|---|---|
| Language | Python |
| GUI | Tkinter |
| Packet capture | Scapy |
| Concurrency | Threading, Queue |
| Logging | CSV, Datetime |
Implements five network attack detection techniques:
- Port Scan Detection
- SYN Flood Detection
- SSH/RDP Brute Force Detection
- Suspicious IP Detection (blacklist-based)
- Payload Anomaly Detection
GUI Dashboard → IDS Engine → Detection Engine ↓ Packet Simulator / Live Capture ↓ Security Logger → Report Generator
- Python 3.9+
- Npcap (Windows) or libpcap (Linux/macOS) for live packet capture
- Administrator/root privileges (required for live packet sniffing)
git clone https://github.com/areebaathar-dev/Network-Intrusion-Detection-System.git
cd Network-Intrusion-Detection-System
pip install -r requirements.txt
python main.py
⚠️ Live Packet Capture Mode requires running with administrator/root privileges. Simulation Mode and PCAP File Analysis Mode do not.
Network-Intrusion-Detection-System/ ├── main.py # Entry point / GUI dashboard ├── detection_engine/ # Attack detection modules ├── packet_simulator/ # Simulated traffic generator ├── logger/ # Security log & CSV generation ├── reports/ # HTML report generator └── models/ # Data models
- Machine learning-based anomaly detection
- Web-based dashboard (replace Tkinter with a browser UI)
- Email/Slack alerts for high-severity threats
This project is licensed under the MIT License.