1. Introduction

The Intrusion Detection System (IDS) for Local Networks is a Python-based cybersecurity project that monitors network traffic in real time to detect suspicious activities and potential intrusions. It analyses data packets passing through the network using signature-based and anomaly-based detection techniques to identify threats such as port scanning, unauthorized access, and denial-of-service (DoS) attempts. The system alerts the user when abnormal behaviour is detected, helping protect home or small office networks from cyberattacks. This project serves as a lightweight, cost-effective, and customizable security layer for local network environments.

2. Existing System vs Proposed System

3. Working

1. Packet Capture: Capture live packets with Scapy/Socket.
2. Feature Extraction: Protocol, src/dst IP, ports, size, rates.
3. Traffic Classification: ML/rules to detect malicious patterns.
4. Alert Generation: Real-time alert on intrusions/anomalies.
5. Logging: Persist traffic/events for audit/analysis.
6. Visualization: Dashboard with stats, detections, health.

4. Technology Stack

• Language: Python
• Libraries: scapy, socket, pandas, scikit-learn, matplotlib, time, tkinter/flask
• Algorithms: Random Forest, Decision Tree, K-Means (anomaly)
• Dataset: KDD Cup 99 / NSL-KDD for model training
• Database: SQLite3 / CSV for logs & events
• Interface: Flask web UI or Tkinter desktop GUI

5. Modules

6. Advantages

• Real-time detection of intrusions and suspicious traffic.
• Lightweight and easy to deploy on home/office LANs.
• Detects known (signature) and unknown (anomaly) threats.
• Visual analytics for clear network insights.
• Boosts resilience without expensive tools.

7. Applications

• Home & small office security monitoring.
• Academic/research work in cybersecurity/network analysis.
• Real-time IDS for LANs and IoT networks.
• Network performance & security auditing.
• Integration with routers/firewalls for advanced protection.

Python Integration Sketch (Scapy + ML + Flask)

# --- Packet capture & feature extraction ---
from scapy.all import sniff, IP, TCP, UDP
import time, queue, threading
import pandas as pd
from sklearn.ensemble import RandomForestClassifier

packet_q = queue.Queue()

def to_feature(pkt):
    feat = {
        "ts": time.time(),
        "proto": 6 if TCP in pkt else (17 if UDP in pkt else 0),
        "src": pkt[IP].src if IP in pkt else "0.0.0.0",
        "dst": pkt[IP].dst if IP in pkt else "0.0.0.0",
        "sport": int(pkt[TCP].sport) if TCP in pkt else (int(pkt[UDP].sport) if UDP in pkt else 0),
        "dport": int(pkt[TCP].dport) if TCP in pkt else (int(pkt[UDP].dport) if UDP in pkt else 0),
        "len": len(pkt)
    }
    return feat

def sniffer():
    sniff(store=False, prn=lambda p: packet_q.put(to_feature(p)))

threading.Thread(target=sniffer, daemon=True).start()

# --- Classifier (placeholder) ---
model = RandomForestClassifier()  # load trained model from disk in real project

# --- Scoring loop & alerting ---
def score_loop():
    buf = []
    while True:
        try:
            feat = packet_q.get(timeout=1)
            buf.append(feat)
            if len(buf) >= 64:
                df = pd.DataFrame(buf)
                # X = transform(df) -> preprocess to features the model expects
                # yhat = model.predict(X); proba = model.predict_proba(X)
                # raise_alerts(df, yhat, proba)
                buf.clear()
        except queue.Empty:
            pass

threading.Thread(target=score_loop, daemon=True).start()

# Flask/Tkinter UI renders charts from SQLite/CSV logs and shows alerts.
              

What You Get