Real-Time IDS with Machine Learning Attack Classification

Real-Time Intrusion Detection System using Signature-Based Detection, DNS Threat Intelligence, and Machine Learning-Based Attack Classification.

---

Overview

This project implements a Real-Time Intrusion Detection System (IDS) that combines Signature-Based Detection, DNS Threat Intelligence, and Machine Learning-Based Attack Classification to identify and categorize suspicious network activities.

The system continuously monitors live network traffic, detects suspicious behavior using predefined signatures and threat intelligence indicators, and classifies detected events into attack categories using a Machine Learning model trained on the UNSW-NB15 dataset.

The IDS was tested in a VMware virtual environment using Kali Linux and Ubuntu machines to simulate attacks and validate detection capabilities.

---

Detection Methods

Signature-Based Detection

Detects common attack patterns including:

• Port Scanning
• SSH Brute Force
• RDP Scanning
• SYN Flood Attacks
• ICMP Flood Attacks

---

DNS Threat Intelligence

Detects communication with known malicious domains.

Example:

malware.wicar.org

The IDS compares DNS queries against a maintained list of known malicious domains and generates alerts when matches are detected.

---

Machine Learning Attack Classification

The Machine Learning model classifies suspicious activities into attack categories from the UNSW-NB15 dataset, including:

• Analysis
• Backdoor
• DoS
• Exploits
• Fuzzers
• Generic
• Normal
• Reconnaissance
• Shellcode
• Worms

---

Dataset

This project uses the UNSW-NB15 dataset developed by the Australian Centre for Cyber Security (ACCS).

Dataset Link:

https://research.unsw.edu.au/projects/unsw-nb15-dataset

The dataset contains modern network traffic and attack scenarios used for training and evaluating intrusion detection systems.

---

Machine Learning Model

The IDS uses a Machine Learning classifier trained on the UNSW-NB15 dataset to categorize detected events into attack families.

The trained model file (intrusion_model.pkl) is not included in this repository due to GitHub file size limitations.

To regenerate the model:

python src/train_model.py

Generated files:

models/
├── intrusion_model.pkl
├── feature_columns.pkl
├── label_encoders.pkl
└── attack_encoder.pkl

---

Installation

Clone Repository

git clone https://github.com/sushmasri-msr/real-time-ids-with-attack-classification.git

cd real-time-ids-with-attack-classification

Create Virtual Environment

python -m venv venv

Activate Virtual Environment

Windows:

venv\Scripts\activate

Linux:

source venv/bin/activate

Install Dependencies

pip install -r requirements.txt

---

Running the IDS

Start IDS Engine

python src/main.py

Select the desired network interface when prompted.

Start Dashboard

python src/dashboard.py

Open:

http://127.0.0.1:5000

---

Attack Simulation

Port Scan

From Kali Linux:

sudo nmap -sS -T5 -p 22,23,445,3306,3389 TARGET_IP

SYN Scan

sudo nmap -sS TARGET_IP

DNS Threat Intelligence Test

nslookup malware.wicar.org

---

Confidence Score Interpretation

The Machine Learning model was trained on the UNSW-NB15 dataset, which contains traffic collected in a controlled laboratory environment.

During deployment, the IDS analyzes live network traffic that may differ significantly from the original training data. Consequently, confidence scores may be lower when observed traffic patterns do not closely resemble the dataset used during training.

Lower confidence scores do not necessarily indicate incorrect classification; rather, they reflect differences between real-world traffic and the training dataset.

---

Screenshots

Dashboard

Attack Simulation

---

Limitations

• Signature-based detection can only identify known attack patterns.
• Machine Learning classification accuracy depends on the quality and diversity of training data.
• The malicious domain database used for DNS Threat Intelligence requires regular updates to remain effective against emerging threats.
• New and previously unseen attack techniques may bypass detection mechanisms.
• Real-world traffic may differ from the laboratory dataset used for training.

---

Future Improvements

• Integration with Suricata rules
• Threat Intelligence API integration
• Automated malicious IP blocking
• SIEM integration (Splunk / ELK)
• Advanced flow-based feature extraction
• XGBoost and LightGBM attack classification
• Automated malicious domain feed updates
• Threat hunting dashboard enhancements

---

Author

Sushma Sri Miryala