Intrusion Detection System (IDS)

A Python-based network intrusion detection system that monitors network traffic in real-time to identify potential security threats and attacks. The system uses packet sniffing, pattern matching, and stateful analysis to detect various types of network-based attacks.

Features

• Real-time Packet Sniffing: Monitors network traffic using Scapy
• Multiple Detection Methods:
  • Signature-based Detection: Identifies known malicious patterns in packet payloads
  • Flood Attack Detection: Detects SYN flood attacks by analyzing connection patterns
  • Port Scan Detection: Identifies port scanning activities
• Stateful Analysis: Tracks network connections over time windows for accurate detection
• Web Dashboard: Flask-based web interface to view alerts and system status
• Alert Logging: Comprehensive logging to both CSV files and log files
• Configurable Thresholds: Easily adjustable detection parameters

Architecture

The system consists of several key components:

• Sniffer (ids/sniffer.py): Captures network packets in real-time
• Analyzer (ids/analyzer.py): Processes packets and coordinates detection modules
• Detectors: Specialized modules for different attack types
  • Signature Detector: Pattern matching for known threats
  • Flood Detector: SYN flood attack detection
  • Scan Detector: Port scanning detection
• State Manager (ids/state_manager.py): Maintains connection state for time-window analysis
• Alert System (ids/alerts.py): Handles alert generation, logging, and CSV export
• Web Interface (app.py): Flask application for viewing alerts via web dashboard

Requirements

• Python 3.7+
• Administrator/root privileges (required for packet sniffing)
• Network interface access

Installation

1. Clone the repository:

   git clone <repository-url>
   cd CN_project_ids

2. Install dependencies:

   pip install -r requirements.txt

   Required packages:

   • scapy: Network packet manipulation and sniffing
   • Flask: Web framework for dashboard
   • pandas: Data manipulation for CSV logging

3. Note: On Linux/macOS, you may need additional permissions or libraries for Scapy to work properly. On Windows, you may need to install Npcap or WinPcap.

Configuration

Edit config.py to customize detection parameters:

# Time window for stateful detection (seconds)
TIME_WINDOW = 10

# SYN Flood detection threshold
SYN_FLOOD_THRESHOLD = 100

# Port Scan detection threshold
PORT_SCAN_THRESHOLD = 20

# Malicious signatures to detect in payloads
MALICIOUS_SIGNATURES = [
    b"MALICIOUS_DATA",
    b"root.exe",
    b"evil_script.sh"
]

Usage

Running the IDS

Important: The IDS requires administrator/root privileges to capture network packets.

1. Start the packet sniffer:

   # On Linux/macOS
   sudo python main.py
   
   # On Windows (run as Administrator)
   python main.py

2. Access the web dashboard (in a separate terminal):

   python app.py

   Then open your browser and navigate to http://127.0.0.1:5000

Web Dashboard

The Flask web application provides:

• Home Page (/): Landing page
• Dashboard (/dashboard): Real-time view of all detected alerts
• About (/about): Information about the system

Network Interface Configuration

If you need to specify a particular network interface, edit ids/sniffer.py and modify the iface parameter in the sniff() function:

sniff(prn=lambda p: analyzer.analyze_packet(p), store=0, iface="your-interface-name")

Detection Capabilities

1. Signature-Based Detection

• Scans packet payloads for known malicious patterns
• Configurable signature list in config.py
• Detects patterns like malicious executables or suspicious scripts

2. SYN Flood Detection

• Monitors SYN packets from individual IP addresses
• Triggers alert when SYN count exceeds threshold within time window
• Helps detect DDoS attacks

3. Port Scan Detection

• Tracks unique ports accessed by each source IP
• Alerts when port count exceeds threshold
• Identifies reconnaissance activities

Output Files

• alerts.csv: Structured CSV file containing all alerts with timestamps, IPs, and details
• ids_alerts.log: Detailed log file with all alert events

Project Structure

CN_project_ids/
├── ids/
│   ├── __init__.py
│   ├── sniffer.py          # Packet capture engine
│   ├── analyzer.py         # Packet analysis coordinator
│   ├── alerts.py           # Alert handling and logging
│   ├── state_manager.py    # Connection state management
│   └── detectors/
│       ├── __init__.py
│       ├── signature_detector.py
│       ├── flood_detector.py
│       └── scan_detector.py
├── templates/
│   ├── index.html          # Home page
│   ├── dashboard.html      # Alert dashboard
│   ├── about.html          # About page
│   └── layout.html         # Base template
├── static/
│   └── style.css           # CSS styles
├── app.py                  # Flask web application
├── main.py                 # IDS entry point
├── config.py               # Configuration file
├── requirements.txt        # Python dependencies
└── README.md              # This file

Important Notes

• Permissions: Always run the IDS with appropriate privileges (sudo/Administrator)
• Performance: The system filters out common web traffic (ports 80, 443) to reduce noise
• False Positives: Adjust thresholds in config.py based on your network environment
• Legal Compliance: Ensure you have authorization to monitor network traffic in your jurisdiction

Troubleshooting

1. Permission Denied Error:

   • Run with administrator/root privileges
   • On Linux: sudo python main.py
   • On Windows: Run PowerShell/CMD as Administrator

2. No Packets Captured:

   • Verify network interface name in sniffer.py
   • Check that you have permission to access the network interface
   • Ensure the interface is active and receiving traffic

3. Import Errors:

   • Verify all dependencies are installed: pip install -r requirements.txt
   • Check Python version (3.7+ required)

Authors

Monish Dasari--24BCE1768 Harshit Vasu--24BCE1468 Govind R Pillai--24BCE1434