This Intrusion Detection System (IDS) monitors network traffic in real-time to identify suspicious activities and potential threats. It uses the Scapy library to capture and analyze network packets, looking for abnormal patterns such as unusually large packets or repetitive requests. Upon detecting anomalies, the IDS can take automated preventive actions, such as blocking suspicious IP addresses using Windows Firewall commands. All detected threats and system events are logged for further analysis and review.
-
Real-time Packet Monitoring: Captures and analyzes network packets in real-time using Scapy. 📡
-
Statistical Analysis: Tracks packet sizes and counts to identify unusual traffic patterns. 📊
-
Anomaly Detection:
- Large Packet Detection: Flags packets larger than 1500 bytes as potentially malicious. 📦
- Repetitive Traffic Detection: Detects repetitive packet sizes (more than 100 times) that may indicate a flood attack. 🔄
-
Automated Response: Blocks offending IP addresses using Windows Firewall commands (requires admin privileges). 🚫
-
Logging: Logs all detected threats, including timestamps and anomaly details, to
ids_logs.log. 📝 -
Alerting (Potential): While not explicitly mentioned, the logging feature facilitates the implementation of alerts (e.g., email notifications) based on log entries. 🔔
-
Python: The core programming language for the IDS. 🐍
-
Scapy: A powerful Python library for network packet manipulation and analysis. 📡
-
Windows Firewall: Used for blocking IP addresses (Windows-specific). 🧱
-
Network Security Professionals: Monitoring network traffic for security threats. 🧑💻
-
Security Researchers: Studying network attacks and developing intrusion detection techniques. 🕵️♀️
-
Python Developers: Learning about network programming, packet analysis, and security concepts. 🧑🎓
-
Clone the repository:
git clone <repo url> -
Install required libraries:
pip install scapy -
Run the program (with administrator privileges):
python ids.py(orpython3 ids.py)