A real-time network intrusion detection system that uses machine learning to identify anomalous network traffic and potential security threats. This project is currently in development.
In an era of increasingly sophisticated cyber attacks, traditional signature-based detection methods are no longer sufficient. This project aims to build a lightweight, intelligent intrusion detection system that learns the baseline of "normal" network activity and flags suspicious deviations in real-time.
By leveraging machine learning, this tool can potentially identify zero-day threats and novel attack patterns that would otherwise go unnoticed. This serves as a practical exploration of applying AI/ML concepts to defensive cybersecurity challenges.
- Live Packet Capture: Sniffs network traffic directly from a network interface.
- Data Preprocessing: Extracts relevant features from raw packet data for analysis.
- Anomaly Detection: Uses an Isolation Forest model to identify outlier packets that deviate from the established baseline.
- (Planned) Protocol-Specific Analysis: Deeper inspection of protocols like DNS and HTTP for malicious patterns.
- (Planned) Dockerization: Containerizing the application for easy deployment.
This project is built using the following core technologies:
To get a local copy up and running, follow these simple steps.
Make sure you have Python 3.9 or higher installed on your system.
- Python 3.9+
- Clone the repository:
git clone https://github.com/esadowski4/mini-morpheus.git
- Navigate to the project directory:
cd mini-morpheus - Create and activate a virtual environment:
# For macOS/Linux python3 -m venv venv source venv/bin/activate # For Windows python -m venv venv .\venv\Scripts\activate
- Install the required packages:
pip install -r requirements.txt
The project currently consists of two main scripts:
- Capture Data: To capture live network traffic and save it for analysis.
python src/capture.py
- Detect Anomalies: To run the ML model on a sample dataset.
python src/detect.py
- Basic packet capture with Scapy
- Feature extraction (packet length)
- Initial anomaly detection model with Scikit-learn
- Save/Load captured data to a
.pcapor.csvfile - Develop more sophisticated features (e.g., protocol type, port numbers)
- Experiment with different ML models (e.g., Autoencoders with PyTorch/TensorFlow)
- Create a simple dashboard to visualize threats
- Containerize the application with Docker
Distributed under the MIT License. See LICENSE for more information.
Eric Sadowski - My LinkedIn - My Email