🛡️ NetGuard AI — Network Threat Intelligence Platform

A Machine Learning–based Network Intrusion Detection System (NIDS) that analyzes PCAP files and live network traffic to detect malicious activity using an ensemble of classifiers combined with anomaly detection via Bayesian fusion.

Live Demo: netguard-nids.streamlit.app  |  GitHub: 27Aditi/netguard-nids

---

Table of Contents

• About the Project
• Technology Stack
• Features
• ML Pipeline
• Project Structure
• Installation and Setup
• Screenshots
• Dataset
• Team Members

---

About the Project

NetGuard AI is a network intrusion detection system built entirely with Streamlit. It processes .pcap and .pcapng capture files and classifies network flows as NORMAL or ATTACK. It extracts 32 flow-level features using NFStream and Scapy, runs them through a trained ensemble of Random Forest, LightGBM, and XGBoost classifiers alongside an Isolation Forest anomaly detector, then combines the outputs via Bayesian fusion to produce a final threat verdict with risk level, threat intensity, and analyst notes.

The system also supports live capture mode on Linux and macOS using Scapy's AsyncSniffer, and provides a real-time threat score chart, session history, and model info panel — all within the Streamlit dashboard.

---

Technology Stack

Layer	Technology
Dashboard / UI	Streamlit
Charts and Visualization	Plotly
Packet Processing	NFStream, Scapy
ML — Supervised	Random Forest, XGBoost, LightGBM (scikit-learn)
ML — Unsupervised	Isolation Forest
Fusion Strategy	Bayesian Combination (50/50 weighted)
Deployment	Streamlit Cloud
Language	Python 3.10+

---

Features

• PCAP File Analysis — Upload any .pcap or .pcapng file for instant threat analysis
• Live Network Capture — Record live traffic from a network interface using Scapy's AsyncSniffer and analyze on-the-fly (Linux/macOS; requires root/admin privileges)
• Ensemble Classification — Random Forest, LightGBM, and XGBoost vote together for robust supervised predictions
• Anomaly Detection — Isolation Forest detects zero-day and unseen attack patterns without labels
• Bayesian Fusion — 50/50 weighted combination of ensemble probability and anomaly score for a single unified threat score
• Real-Time Threat Chart — Rolling average line chart of per-flow Bayesian scores powered by Plotly
• Human-Readable Verdict — Risk Level (Low / Medium / High), Network Status (Safe / Suspicious / Danger), Threat Intensity %, Traffic Behavior (Stable / Unstable / Erratic), and Analyst Note
• Session History — All past analysis sessions stored and accessible in the sidebar via Streamlit session state
• 32 Flow-Level Features — Carefully engineered from the UNSW-NB15 feature set
• 9 Attack Categories Covered — Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms

---

ML Pipeline

1. PCAP File
      |
      v
2. NFStream  -->  Flow-level DataFrame (bidirectional stats)
      |
      v
3. Scapy (single-pass)  -->  Raw packet features
                              TTL, TCP window, RTT, HTTP depth,
                              FTP login, response body length
      |
      v
4. 32 Features Extracted
      |
      |--  Label Encoding (proto, service, state)
      |--  MinMax Scaling
      |
      v
5. Ensemble Classifier
      RF + LightGBM + XGBoost  -->  avg attack probability
      |
      |        6. Isolation Forest
      |               anomaly score normalized to [0, 1]
      |                    |
      v                    v
7. Bayesian Combination  (0.5 x ensemble + 0.5 x IF)
      |
      v
8. Combined Score >= Threshold?
      |
      |-- YES -->  ATTACK
      |-- NO  -->  NORMAL

Features Extracted (32)

dur proto service state spkts dpkts sbytes dbytes sttl dttl sload dload sloss dloss sinpkt swin dwin tcprtt synack smean dmean trans_depth response_body_len ct_srv_src ct_state_ttl ct_src_dport_ltm ct_dst_sport_ltm ct_dst_src_ltm is_ftp_login ct_flw_http_mthd ct_srv_dst is_sm_ips_ports

---

Project Structure

netguard-nids/
|
|-- dashboard.py               (Streamlit app — all pages and UI)
|
|-- pipelines/
|   |-- feature_extraction.py  (NFStream + Scapy feature extraction)
|   |-- prediction.py          (Prediction pipeline + verdict logic)
|
|-- models/
|   |-- classifiers/
|   |   |-- final_rf.pkl       (Random Forest)
|   |   |-- final_lgbm.pkl     (LightGBM)
|   |   |-- final_xgb.pkl      (XGBoost)
|   |
|   |-- anomaly/
|   |   |-- isolation_forest.pkl
|   |
|   |-- scalers/
|   |   |-- nidss_scaler.pkl   (Ensemble scaler)
|   |   |-- if_scaler.pkl      (Isolation Forest scaler)
|   |
|   |-- encoders/
|   |   |-- nidss_encoders.pkl (Label encoders for proto, service, state)
|   |
|   |-- feature_order/
|   |   |-- nidss_features.pkl
|   |   |-- if_feature_order.pkl
|   |
|   |-- threshold/
|       |-- final_threshold.pkl
|
|-- requirements.txt
|-- README.md

---

Installation and Setup

Prerequisites

• Python 3.10+
• Npcap (Windows) or libpcap (Linux/macOS) — required by Scapy and NFStream

1. Clone the Repository

git clone https://github.com/27Aditi/netguard-nids.git
cd netguard-nids

2. Create and Activate a Virtual Environment

python -m venv venv

# Windows
venv\Scripts\activate

# Linux / macOS
source venv/bin/activate

3. Install Dependencies

pip install -r requirements.txt

Or manually:

pip install streamlit plotly nfstream scapy
pip install xgboost lightgbm scikit-learn joblib

4. Run the App

streamlit run dashboard.py

Open http://localhost:8501 in your browser.

Note: Live Capture requires root/admin privileges. On Linux/macOS run sudo streamlit run dashboard.py. On Windows, use Wireshark to capture a .pcap file and upload it via the Upload and Analyze tab instead.

5. Add Your Trained Models

Place your .pkl model files in the models/ directory following the structure above. If no models are found, the app runs in demo mode with simulated results.

---

Screenshots

Live Capture Mode

The Live Network Capture tab lets users start real-time packet recording directly from a network interface. Captured traffic is automatically saved and analyzed when recording stops.

Threat Detected — Upload and Analyze Mode

After uploading a PCAP file and clicking Analyze, the dashboard displays the full verdict including threat status, risk level, and the AI-generated analyst note.

---

Dataset

Trained on the UNSW-NB15 dataset — a comprehensive network intrusion dataset generated by the IXIA PerfectStorm tool at the Australian Centre for Cyber Security (ACCS).

Property	Value
Total Flows	2.5 million+
Attack Categories	9 (Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms)
Features Used	32 (subset of UNSW-NB15 feature set)

---

Team Members

Name
Aditi Bhatnagar
Abhinay Jat

B.Tech — Computer Science and Engineering

---

License

This project is intended for educational and research purposes.