README.md

Intrusion Detection System with Machine Learning

Packages needed to be installed:

• scapy
• duckdb
• sklearn
• seaborn
• matplotlib

Modules Roadmap:

• Module 1: Package capture
• Module 2: Rule-based detection
  • 1. Checksom Verification
  • 2. Payload Pattern Matching
  • 3. Rate-Based Anomaly Detection
  • 4. Malformed Packet Detection
  • 5. ICMP Flood Detection
  • 6. DNS Spoofing Detection
  • 7. ARP Spoofing Detection
  • 8. Protocol-Specific Anomalies
    • 8.1 Fragment checks
    • 8.2 Valid Handshake Check
  • 9. Content-Learning Mismatch
  • Additional checks:
    • IP Spoofing Detection
    • SYN FIN Combination Detection
    • null Packet Detection
    • Malicious Ports Detection
    • More DNS Spoofing Detection
    • Destination Checks
    • TCP reset Detection
• Module 3: Anomaly-based detection
  • Logistic Regression
  • Decision Tree Classifier
  • KNN
  • Random Forest