Project Overview
Understanding the Network Intrusion Detection Pipeline
AI Intrusion Detection System
Network intrusion detection plays a pivotal role in modern cybersecurity. This project implements a machine learning system trained on the benchmark CICIDS2017 dataset to classify network packet flows as BENIGN or ATTACK with ultra-high accuracy.
Rather than relying on simple rule-based signatures, this system extracts traffic behaviors (packet sizes, flow intervals, header ratios) to recognize malicious patterns like Distributed Denial of Service (DDoS), Port Scanning, and Web Brute Forcing.
Class Imbalance SMOTE
Handles extreme minor class representations using synthetic oversampling.
Leakage Prevention
Detects and drops ports features to prevent model overfitting.
Robust Feature Selection
Selects the top 30 features by log-scaling and RF Permutation analysis.
Pipeline Architecture
CICIDS2017 Dataset
Raw PCAP Traffic Features
Data Cleaning & Sampling
Duplication & Missing Imputation
Feature Engineering
Log-Scale & Corr Filter (>0.9)
Balanced RF / XGBoost
Dropped Ports (Zero Data Leakage)
2.8 Million
Combined PCAP flows
99.98%
Robust RF accuracy
< 5 ms
Classification latency
Packet Feature configuration
Threat Assessment
Awaiting Analysis
Select a preset or configure custom parameters, then hit "Analyze Packet Flow" to check threat levels.
Analyzing Traffic Flow
Running features log-scale conversion and classification...
TRAFFIC SECURE
Normal Flow Signature: 100.0% Match
INTRUSION DETECTED
Malicious Signature: 99.8% Confidence
Live Traffic Analyzer
Traffic Classification Rates
Intrusion Alert Ratio
Feature Importance (Robust Model)
Model Comparison (F1 Score)
Evaluation Performance Matrix
| Model Algorithm | Feature Setup | Accuracy | Precision | Recall (TPR) | F1-Score |
|---|---|---|---|---|---|
| Random Forest | Robust (No Ports) | -- | -- | -- | -- |
| XGBoost Classifier | Robust (No Ports) | -- | -- | -- | -- |
| Logistic Regression | Robust (No Ports) | -- | -- | -- | -- |
| Random Forest | With Ports (Leaky) | -- | -- | -- | -- |
| XGBoost Classifier | With Ports (Leaky) | -- | -- | -- | -- |
| Logistic Regression | With Ports (Leaky) | -- | -- | -- | -- |
The Port-Based Leakage Problem
In network flow datasets like CICIDS2017, features like Source Port and
Destination Port contain significant target leakage. Because certain
automated attack scripts are executed from standard ports or target specific ports
(e.g., Port 80 for HTTP, 22 for SSH, or custom ephemeral ports), a machine learning
model can easily overfit to the port numbers.
While this model achieves nearly 99.99% accuracy in test datasets, it behaves like a hard-coded firewall rule, losing its generalizability. In the real world, hackers can launch SQL injections or DDoS attacks on arbitrary, custom ports. A model that relies on port features will be completely blinded if the ports are altered.
Our Counter-Measure
By identifying and dropping port features during training, we force the Random Forest classifier to learn structural signatures (such as flow duration, inter-arrival times, payload sizes) making it highly resilient.
Port Leakage Interactive Proof
Load a preset attack packet below. We'll show how the Robust Model behaves versus a model trained with Data Leakage (Ports Allowed) when we manipulate the port number.
Model WITH Ports
Failed to detect attack!
Robust Model (No Ports)
Correctly identified!