Network Intrusion Detection System (NIDS) is a machine-learning-based system for detecting malicious network traffic in real time. The system uses the CIC-IDS2017 dataset to train supervised learning models and combines packet capture, flow generation, feature extraction, ML-based classification, alerting, and automated IP blocking into a single pipeline.

The system captures network traffic directly from a device's Wi-Fi or Ethernet interface, aggregates individual packets into network flows, extracts flow-level statistics, and passes the resulting features through the trained ML pipeline. Random Forest and XGBoost models are used to classify network traffic as benign or malicious.

When suspicious traffic is detected, the system generates an alert and can trigger an IP-blocking mechanism to prevent further communication from identified sources.

Detection Pipeline

Network Interface → Packet Capture → Flow Generation → Feature Extraction → Preprocessing → ML Classification → Alert → IP Blocking

Key Components CIC-IDS2017 — Dataset used for supervised intrusion detection model training Scapy + Npcap — Real-time packet capture FlowTable — Aggregates packets into bidirectional network flows Random Forest & XGBoost — Machine-learning classifiers FastAPI — Backend API for detection control and monitoring Alert System — Records and exposes detected threats IP Blocking — Automated response to malicious traffic Docker/Docker Compose — Application deployment and environment management