Network Intrusion Detection System using Machine Learning

Classifies network traffic as normal or malicious using a trained ML model.

Rule-based intrusion detection recognises attacks that someone has already described, but new or slightly changed attacks slip past, while broad rules bury analysts in false alarms. Machine learning can learn what malicious traffic looks like from examples. This project trains models to classify network traffic as normal or malicious and compares which approach works best.

Using a labelled intrusion dataset, the project extracts flow-level features such as duration, packet and byte counts, protocol and flag statistics, cleans and scales them, and removes redundant features. Because attacks are rare, class imbalance is handled with class weights and resampling. Logistic regression, decision tree, random forest and gradient boosting models are trained with scikit-learn and tuned with cross-validation, and results are compared using accuracy, precision, recall and the F1 score, with the attack recall stressed because missed attacks are costly. Feature importance shows which traffic characteristics reveal each attack family. A live demo converts traffic captured with Wireshark into the same features and flags suspicious flows on a small monitor.

You will learn network traffic basics, feature engineering, imbalanced classification and model evaluation for security. The Project Reference Guide explains each step and the limits of the approach, and the Reference Implementation contains the notebooks, saved model and live monitor.