NetSpect v1.0.0

Overview

NetSpect is a Hybrid IDS developed as the culmination of our four-year Software Engineering degree. Engineered for accuracy, efficiency, and ease of use it features an intuitive graphical user interface (GUI) paired with a robust backend to deliver a comprehensive solution for real-time threat detection in local networks. By integrating custom-designed algorithms with machine learning, NetSpect combines signature-based and anomaly-based detection methods to monitor and analyze network traffic, ensuring precise, rapid, and reliable detection of malicious activities.

Our software includes a specialized algorithm for ARP Spoofing detection, capable of identifying both IP-MAC and MAC-IP spoofing across individual subnets in real time. This algorithm systematically analyzes incoming ARP traffic, organizes it by subnet, and verifies the absence of duplications indicative of spoofing attempts. Enhanced by a cache-based mechanism, it optimizes data processing to achieve efficient and accurate detection, providing robust protection against network spoofing threats with minimal performance impact.

In addition to that, the machine learning models that we built were trained on datasets we manually collected from various Ethernet and Wi-Fi networks. These datasets include benign network traffic as well as attack traffic synthesized from real-world scenarios we created in controlled environments, covering threats such as Port Scanning, DoS TCP SYN Floods, DoS HTTP GET Floods, and DNS Tunneling. This hands-on approach to data collection ensures our models are finely tuned to recognize both typical network behavior and sophisticated attack patterns effectively.

NetSpect cleverly employs a multi-threaded architecture to distribute tasks across multiple worker threads, delivering strong performance and real-time detection capabilities. This design enables the application to maintain high responsiveness and process network traffic efficiently, even under significant load. By leveraging multi-threading, NetSpect provides a scalable and dependable solution for monitoring and securing local networks in dynamic environments.

Features

Core Features

• Real-Time Detection
  Detects ARP Spoofing, Port Scanning, DoS and DNS Tunneling network attacks in real time with high accuracy and efficiently.

• Signeture-Based Algorithms
  Implements a custom logic-based algorithm to detect ARP spoofing attack in network traffic that incorporates an authentication mechanism for each IP-MAC address pair within every subnet and adapts to legitimate network changes.

• Anomaly-Based Machine Learning Classification
  Uses pre-trained SVM models to classify network flows and detect Port Scanning, DoS and DNS Tunneling attack signatures in real time.

• Data Collection
  Provides the ability to switch between Detection and Data Collection modes. In Data Collection mode, network packets are aggregated and stored in a CSV file for further analysis.

• MAC Address Blacklist
  Allows users to add MAC addresses to a blacklist. Any attacks originating from these addresses will be ignored during detection.

Interface Features

• Alert Center
  Monitor real-time and past alerts directly in the app, and control detection with start and stop functionality.

• Analytics Center
  Allows the user to visualize their previous alerts in a simple and informative way, organized by year.

• Incident Reports
  Enables users to filter and export historical alerts into TXT or CSV report formats for future analysis.

• Modern GUI with Dark/Light Mode
  Clean and responsive user interface built with user experience in mind, featuring light and dark mode color schemes.

User & System Features

• User Authentication
  Supports login and registration, along with a guest mode with limited functionality.

• Account Management
  Offers users the ability to changing their password, username, and email address. Also includes a password recovery feature in case of forgotten credentials.

• System Information
  Displays detailed information about the user’s network interface, system details and the current program version.

• RESTful API Server
  Provides backend API built with FastAPI, handling database operations and exposing RESTful endpoints for client-server interactions.

Performance & Compatibility Features

• Multithreaded Architecture
  Efficient and responsive performance with concurrent data capture and processing.

• System Tray Integration
  Runs in the background and shows native tray notifications upon attack detection.

• Cross-Platform
  Compatible with Windows, Linux, and macOS thanks to Python 3.13 and PySide6.

• Flexible Backend Integration
  Compatible with any RESTful backend framework, enabling easy integration and seamless communication.