🛡️ AI-Powered Intrusion Detection System

A real-time network intrusion detection system using Machine Learning for automated threat detection with a retro terminal-style dashboard.

---

🌟 Features

• 🔍 Real-time Packet Capture - Live network traffic monitoring with PyShark
• 🤖 ML-Based Detection - Random Forest classifier trained on CICIDS2018 dataset
• 🎨 Retro Terminal UI - Cyberpunk-style Streamlit dashboard
• 📊 Flow Analysis - Network flow aggregation and statistical feature extraction
• 🧠 AI Explanations - Optional Ollama integration for threat analysis
• 🐳 Docker Ready - One-command containerized deployment
• ☁️ Cloud Compatible - Deploy to AWS, GCP, or Azure free tiers

---

🚀 Quick Start

Option 1: Local Deployment (Fastest)

# Open PowerShell as Administrator
python run_ids.py

Access dashboard at: http://localhost:8501

Option 2: Docker Deployment

# Windows
.\deploy_local.ps1

# Linux
sudo bash deploy_local.sh

📖 Full deployment guide: See QUICKSTART.md

---

📋 Prerequisites

• Python: 3.11+ (with packages: streamlit, pyshark, scikit-learn, pandas, joblib)
• System: Windows 10/11 or Linux
• Permissions: Administrator/root (for packet capture)
• Optional: Docker Desktop (for containerized deployment)

---

📁 Project Structure

AI_IDS Project/
├── 🐍 Application
│   ├── run_ids.py              # Main orchestrator
│   ├── app.py                  # Streamlit dashboard
│   └── packet_sniffer/
│       └── sniffer_01.py       # Packet capture & ML inference
│
├── 🤖 Machine Learning
│   ├── rf_cicids_binary.joblib # Trained Random Forest model
│   ├── model_metrics01.json    # Model performance metrics
│   └── rf_training.ipynb       # Training notebook
│
├── 🐳 Deployment
│   ├── Dockerfile              # Container configuration
│   ├── docker-compose.yml      # Service orchestration
│   ├── deploy_local.ps1        # Windows deployment
│   ├── deploy_local.sh         # Linux deployment
│   └── requirements.txt        # Python dependencies
│
└── 📚 Documentation
    ├── README.md               # This file
    ├── QUICKSTART.md           # 5-minute deployment guide
    ├── README_DEPLOYMENT.md    # Comprehensive deployment docs
    └── REMOTE_ACCESS.md        # Remote access & tunneling

---

🎯 Attack Detection

The system detects the following attack types:

• ✅ Benign Traffic - Normal network activity
• 🔥 DoS Attacks - Denial of Service
• 🔐 FTP Bruteforce - FTP authentication attacks
• 🔑 SSH Bruteforce - SSH authentication attacks

Model Performance:

• Accuracy: 99.99%
• F1 Score: 0.9999
• ROC-AUC: 1.0000

---

🔧 Configuration

Environment Variables

Create a .env file from the template:

cp .env.example .env

Available Settings:

Variable	Default	Description
NETWORK_INTERFACE	Wi-Fi	Network interface to monitor
STREAMLIT_PORT	8501	Dashboard port
OLLAMA_ENABLED	true	Enable AI explanations
FLOW_TIMEOUT	2.0	Flow timeout (seconds)

---

🌐 Deployment Options

🏠 Local Deployment

Run directly on your machine without Docker:

python run_ids.py

🐳 Docker Deployment

Containerized deployment for isolation and portability:

# Build and run
docker-compose up -d

# View logs
docker logs -f ai-ids-system

# Stop
docker-compose down

☁️ Cloud Deployment

Deploy to cloud platforms (free tiers available):

AWS EC2:

# Launch t2.micro instance (12 months free)
# Install Docker, upload project
sudo bash deploy_local.sh

Google Cloud / Azure: See README_DEPLOYMENT.md

🌍 Remote Access

Share your dashboard publicly for demos:

# Using Cloudflare Tunnel (free, unlimited)
cloudflared tunnel --url http://localhost:8501

# Get public URL: https://random-name.trycloudflare.com

See REMOTE_ACCESS.md for detailed setup.

---

📊 Dashboard Features

Live Monitoring

• Real-time severity overview (Low/Medium/High/Critical)
• New logs since last refresh
• Historical log analysis

Flow Inspection

• Detailed packet statistics
• Traffic direction analysis
• TCP flag analysis
• Raw flow records

AI Analysis (Optional)

• Ollama-powered threat explanations
• SOC analyst assistant
• Remediation recommendations

---

🛠️ Development

Running Without Docker

# Install dependencies
pip install -r requirements.txt

# Run packet sniffer
python packet_sniffer/sniffer_01.py

# Run dashboard (in another terminal)
streamlit run app.py

Training Your Own Model

See rf_training.ipynb for:

• Dataset preprocessing
• Feature engineering
• Model training
• Performance evaluation

---

📖 Documentation

Document	Description
QUICKSTART.md	Get started in 5 minutes
README_DEPLOYMENT.md	Complete deployment guide
REMOTE_ACCESS.md	Remote access setup
DEPLOYMENT_STATUS.md	Current system status

---

🔒 Security Considerations

⚠️ Important: This system requires privileged access for packet capture.

Best Practices:

• Run on trusted networks only
• Use administrator/root privileges responsibly
• Implement authentication for public access
• Use HTTPS for remote access (automatic with tunneling)
• Monitor resource usage

For Production:

• Add Streamlit authentication
• Implement firewall rules
• Use SSL certificates
• Regular security updates

---

🧪 Testing

Test Network Capture

# Generate traffic
ping google.com
curl http://example.com

# Check dashboard for new flows

Verify Model Predictions

Dashboard should show classifications for captured traffic:

• Most traffic: Benign
• Port scans: DoS (if detected)
• Bruteforce attempts: FTP-BruteForce or SSH-Bruteforce

---

🐛 Troubleshooting

Dashboard Not Opening

# Check if Streamlit is running
netstat -ano | findstr :8501

# Verify Python packages
pip list | findstr streamlit

No Traffic Captured

1. Check permissions: Run as Administrator/root
2. Verify interface: Ensure NETWORK_INTERFACE matches your actual interface
3. Generate traffic: Browse websites, ping servers

Docker Issues

# Verify Docker is running
docker ps

# Check container logs
docker logs ai-ids-system

# Rebuild if needed
docker-compose down
docker-compose build --no-cache
docker-compose up -d

See README_DEPLOYMENT.md for more troubleshooting.

---

📈 System Requirements

Minimum:

• CPU: 1 core
• RAM: 512 MB
• Disk: 5 GB free space
• Network: Active interface

Recommended:

• CPU: 2+ cores
• RAM: 2 GB
• Disk: 10 GB free space
• Network: Gigabit connection

---

🎓 About the Model

Algorithm: Random Forest Classifier
Dataset: CICIDS2018 (Canadian Institute for Cybersecurity)
Features: 9 statistical flow features
Classes: 4 (Benign, DoS, FTP-BruteForce, SSH-Bruteforce)

Performance Metrics:

• Training Accuracy: 99.99%
• Weighted F1 Score: 0.9999
• ROC-AUC (OvR): 1.0000

Note: High accuracy may indicate dataset simplicity. Results reported transparently.

---

📝 License

This project is for educational and demonstration purposes only.

Dataset: CICIDS2018 © Canadian Institute for Cybersecurity

---

🤝 Support

• Documentation: Check the guides in this repository
• Issues: Review troubleshooting sections
• Questions: Refer to detailed deployment documentation

---

🎯 Quick Links

• Start Deployment: QUICKSTART.md
• Full Deployment Guide: README_DEPLOYMENT.md
• Remote Access Setup: REMOTE_ACCESS.md
• System Status Check: DEPLOYMENT_STATUS.md

---

🏆 Features Checklist

• Real-time packet capture
• ML-based threat detection
• Retro terminal dashboard
• Flow-based analysis
• Docker containerization
• Cross-platform support
• Cloud deployment ready
• Remote access capable
• Comprehensive documentation
• Production-ready

---

🚀 Ready to deploy? Start with QUICKSTART.md!

---

Built with ❤️ for cybersecurity education and research.