Sentinet - ML-Powered Intrusion Detection System

Sentinet is a Machine Learning-powered network intrusion detection system (IDS) that uses anomaly detection to identify malicious network traffic in real-time.

Built with Python, Flask, and Scikit-learn.

🚀 Features

• ML-Based Detection: Uses an Isolation Forest (Unsupervised Learning) model trained on synthetic network flow data mimicking the CICIDS2017 dataset.
• Real-time Dashboard: A dark-themed, responsive web UI (Flask + Bootstrap) that displays live traffic and alerts.
• Anomaly Highlighting: Automatically flags suspicious packets (e.g., DoS attacks, port scanning) in red.
• Traffic Simulation: Includes a built-in traffic generator to demonstrate detection capabilities without needing live malware.

🛠️ Technology Stack

• Backend: Python, Flask
• Machine Learning: Scikit-learn, Pandas, NumPy
• Frontend: HTML5, Bootstrap 5, JavaScript (Fetch API)
• Data Serialization: Joblib

📦 Installation

1. Clone the repository:

   git clone https://github.com/AtlastDeepLearning/SentiNet.git
   cd sentinet

2. Create and activate a virtual environment (recommended):

   # Windows
   python -m venv venv
   .\venv\Scripts\activate
   
   # Mac/Linux
   python3 -m venv venv
   source venv/bin/activate

3. Install dependencies:

   pip install -r requirements.txt

🏃 Usage

1. Train the Model

Before running the app, generate data and train the model. This creates the model.pkl and scaler.pkl artifacts.

# Generate synthetic training data
python ml/data_generator.py

# Train the Isolation Forest model
python ml/train.py

2. Run the Application

Start the Flask development server:

python run.py

3. Open the Dashboard

Navigate to http://127.0.0.1:5000 in your browser.

• Click "Start Simulation" to begin analyzing traffic.
• Watch as the system identifies "ATTACK" traffic based on flow duration, packet counts, and other features.

📂 Project Structure

sentinet/
├── app/
│   ├── templates/      # HTML templates
│   ├── routes.py       # API endpoints and views
│   ├── traffic_generator.py # Simulates network traffic
│   └── __init__.py     # Flask app factory
├── ml/
│   ├── data_generator.py # Creates synthetic CICIDS2017-like data
│   ├── train.py        # Trains the Isolation Forest model
│   ├── preprocess.py   # Feature scaling and prediction logic
│   └── synthetic_data.csv # Generated dataset
├── run.py              # Entry point
├── requirements.txt    # Project dependencies
└── README.md           # This file

🧠 How it Works

1. Data Generation: The system simulates network flows. "Benign" traffic mimics standard web browsing (Port 80/443, short duration). "Attack" traffic mimics DoS or Port Scans (High ports, long duration, high packet count).
2. Preprocessing: Features are standardized (scaled) to ensure the ML model interprets them correctly.
3. Detection: The Isolation Forest algorithm assigns an anomaly score. If the score is negative, the traffic is classified as an ATTACK.

🛡️ License

This project is for educational purposes.