|
|
--- |
|
|
title: AI NIDS Student Project |
|
|
emoji: 🛡️ |
|
|
colorFrom: blue |
|
|
colorTo: green |
|
|
sdk: streamlit |
|
|
sdk_version: 1.39.0 |
|
|
app_file: app.py |
|
|
pinned: false |
|
|
|
|
|
|
|
|
--- |
|
|
# 🛡️ AI-Based Network Intrusion Detection System (Student Project) |
|
|
|
|
|
Project Status: Phase 1 – Pre-Production / Offline Prototype |
|
|
|
|
|
This project demonstrates how to use **Machine Learning (Random Forest)** and **Generative AI (Groq)** to detect and explain network attacks (specifically DDoS). |
|
|
|
|
|
## 🚀 How to Use |
|
|
|
|
|
1. **Enter API Key:** Paste your Groq API key in the sidebar (optional, for AI explanations). |
|
|
2. **Train Model:** Click the "Train Model Now" button. The system loads the `Friday-WorkingHours...` dataset automatically. |
|
|
3. **Simulate:** Click "🎲 Capture Random Packet" to pick a real network packet from the test set. |
|
|
4. **Analyze:** See if the model flags it as **BENIGN** or **DDoS**, and ask Groq to explain why. |
|
|
|
|
|
## 📂 Files |
|
|
|
|
|
- `app.py`: The main Python application code. |
|
|
- `requirements.txt`: List of libraries used. |
|
|
- `Friday-WorkingHours-Afternoon-DDos.pcap_ISCX.csv`: The dataset (CIC-IDS2017 subset). |
|
|
|
|
|
## 🔧 PHASE 0 — Foundation Hardening (completed) |
|
|
|
|
|
This repository includes an incremental, production-aligned hardening of the original student project. |
|
|
|
|
|
- Deterministic reproducibility (global seed, logging). |
|
|
- Explicit data validation and feature checks. |
|
|
- Class-imbalance handling via `class_weight='balanced'`. |
|
|
- Stratified 5-fold cross-validation with per-fold metrics. |
|
|
- Evaluation metrics replaced accuracy with: precision, recall, F1, PR-AUC, ROC-AUC, and confusion matrices. |
|
|
- Artifacts saved to `models/` and `metrics/` (see below). |
|
|
|
|
|
These changes are intentionally small and reversible — see `training_utils.py` for the training implementation. |
|
|
|
|
|
## 📦 Artifacts (generated after training) |
|
|
|
|
|
- `models/rf_model.joblib` — serialized RandomForest model (best fold). |
|
|
- `metrics/training_metrics.json` — timestamped CV metrics including PR-curve, seed, feature list. |
|
|
|
|
|
## ⚠️ Dataset & Publishing |
|
|
|
|
|
- ⚠️ Dataset Note: The full CIC-IDS2017 CSV (~96 MB) is intentionally excluded from GitHub. |
|
|
This repository focuses on model architecture and training logic. A small sample or synthetic dataset (`sample_data/sample_small.csv`) is included for demos; the full dataset is not committed. |
|
|
|
|
|
## ▶️ Run locally |
|
|
|
|
|
1. Create a virtual environment and install dependencies: |
|
|
|
|
|
```powershell |
|
|
python -m venv .venv |
|
|
.\.venv\Scripts\Activate.ps1 |
|
|
pip install -r requirements.txt |
|
|
``` |
|
|
|
|
|
2. Run the Streamlit app: |
|
|
|
|
|
```powershell |
|
|
streamlit run app.py |
|
|
``` |
|
|
|
|
|
## Contact / Next steps |
|
|
|
|
|
If you want, I can generate a small sample CSV (e.g., 1k rows) that allows publishing the repo to GitHub safely. |
|
|
|
|
|
## 🎓 About |
|
|
|
|
|
Created for a university cybersecurity project to demonstrate the integration of traditional ML and LLMs in security operations. |
|
|
|
