AI-Based Intrusion Detection

A five-class machine-learning intrusion detection workflow developed using traffic generated in an emulated Software-Defined Networking environment.

The repository includes the SDN topology and forwarding controller, the packet-processing and feature-engineering pipeline, model-training code, a serialized model bundle, and a Flask dashboard for analysing recorded packet-level CSV files.

Validated scope: offline CSV-based inference and visualisation.
Not implemented in the final controller: live model inference and automatic OpenFlow mitigation.

---

Traffic Classes

Label	Class
0	Normal
1	DDoS
2	PortScan
3	Fuzzer
4	BruteForce

---

Workflow

Mininet + Open vSwitch + Ryu
              |
              v
  Traffic generation and capture
              |
              v
 Cleaning, labeling, and merging
              |
              v
 100-packet sliding windows
      with a 10-packet step
              |
              v
      31 model features
              |
              v
 Training and model evaluation
              |
              v
       ids_bundle.pkl
              |
              v
 Flask dashboard CSV inference

The Ryu controller manages Layer-2 forwarding. Machine-learning inference is performed separately by the CSV-based dashboard and command-line prediction pipeline.

---

Final Repository Structure

ML-based-Intrusion-detection-system/
├── README.md
├── LICENSE
├── .gitignore
├── .gitattributes
├── requirements.txt
├── app.py
├── features_final.csv
│
├── models/
│   └── ids_bundle.pkl
│
├── templates/
│   └── index.html
│
├── modules/
│   ├── config.py
│   ├── data_loading.py
│   ├── eda.py
│   ├── feature_extraction.py
│   ├── predict.py
│   ├── train.py
│   └── utils.py
│
├── notebook/
│   ├── multi_attack_slidingWindow_v4.ipynb
│   └── readme.md
│
└── sdn/
    ├── README.md
    ├── topology/
    │   └── topo.py
    └── controller/
        └── traffic_controller.py

features_final.csv and models/ids_bundle.pkl are stored through Git Large File Storage.

---

Dataset and Feature Extraction

The raw packet-level CSV format expected by the dashboard is:

Time,Source,Destination,Protocol,Length,Info

The final feature-generation configuration uses:

• Window size: 100 packets
• Step size: 10 packets
• Overlap: 90%
• Input features: 31
• Task: single-label five-class classification

The final 31 model features are:

pkt_count, byte_total, byte_mean, byte_std, byte_min, byte_max,
pkt_rate, byte_rate, flow_duration,
IAT_mean, IAT_std, IAT_min, IAT_max, IAT_total,
SYN_count, ACK_count, FIN_count, RST_count, PSH_count,
syn_ratio, ack_ratio, fin_ratio, rst_ratio, psh_ratio,
syn_no_ack, n_unique_src, n_unique_dst, n_unique_flows,
n_unique_dports, n_unique_sports, protocol_entropy

features_final.csv is already a window-level feature dataset. It is used by the Overview and Visualisations sections and should not be uploaded to the Flow Inspector as a raw capture.

---

Machine-Learning Models

The project evaluates:

• Decision Tree
• Random Forest
• Logistic Regression
• Linear Support Vector Machine
• XGBoost
• Soft-voting ensemble

Evaluation includes accuracy, weighted precision, weighted recall, weighted F1-score, macro ROC-AUC, confusion matrices, feature importance, training time, and prediction time.

The serialized bundle is stored at:

models/ids_bundle.pkl

The notebook preserves the experimental workflow, while modules/ provides a reusable Python implementation for training and prediction.

---

Dashboard

The dashboard is implemented with Flask, Flask-SocketIO, pandas, NumPy, scikit-learn, joblib, Chart.js, and Socket.IO.

It provides:

• packet-level CSV upload;
• sliding-window feature extraction;
• window-by-window predictions;
• threat alerts;
• class and dataset summaries;
• feature distributions and importance;
• model comparison;
• confusion matrices and classification reports.

Install

Clone the repository:

git clone https://github.com/alyaaahmed019/ML-based-Intrusion-detection-system.git
cd ML-based-Intrusion-detection-system

Retrieve the Git LFS objects:

git lfs install
git lfs pull

Create a virtual environment.

Windows using Git Bash:

py -m venv .venv
source .venv/Scripts/activate

Linux:

python3 -m venv .venv
source .venv/bin/activate

Install the dashboard dependencies:

python -m pip install --upgrade pip
pip install -r requirements.txt

Run

Confirm that the following files exist:

app.py
features_final.csv
models/ids_bundle.pkl
templates/index.html

Start the dashboard:

python app.py

Open:

http://127.0.0.1:5000

---

SDN Environment

The final topology is:

s1 ----- s2 ----- s3 ----- s4 ----- s5
 |        |        |        |        |
h1-h4   h5-h8   h9-h12  h13-h16  h17-h20

It contains one remote controller c0, five OpenFlow 1.3 switches, and twenty hosts distributed four per switch.

The final controller is a forwarding-only Ryu application. It performs reactive MAC learning and installs temporary Layer-2 forwarding rules. It does not load the model bundle or install attack-blocking rules.

Run the controller

ryu-manager sdn/controller/traffic_controller.py

Run the topology in another terminal

sudo python3 sdn/topology/topo.py

Inside Mininet:

nodes
links
pingall
h2 curl http://10.0.0.1

More information is available in sdn/README.md.

---

Command-Line Training and Prediction

The reusable pipeline is under modules/.

Train using the configured source datasets:

python -m modules.train

Predict a new packet-level CSV using a saved bundle:

python -m modules.predict path/to/capture.csv --bundle models/ids_bundle.pkl

Review modules/config.py before training because dataset paths and labeling intervals are environment-specific.

---

Limitations

• The final Ryu controller and the machine-learning dashboard are not connected through a live inference path.
• Automatic OpenFlow mitigation is not part of the validated final implementation.
• The dashboard is intended for trusted local demonstration and is not hardened for public Internet deployment.
• Pickle and joblib files must only be loaded from trusted sources.
• The original large raw packet captures are not included.
• Reproducing the serialized model may require package versions compatible with the environment in which it was trained.

---

Project Team

• Shahd Adel Ahmed
• Aliaa Ahmed Atef
• Ali ElDin Tarek Ali — Machine-learning workflow, SDN implementation, evaluation, documentation, and repository organization. GitHub: @aliElDinTarek
• Omnia Adel Ahmed
• Omar Hesham Ebrahiem

Supervisor: Dr. Samar Ashraf

Contributor usernames and detailed responsibilities can be added after they are confirmed.

---

License

This project is licensed under the MIT License.