NIDS is a real-time Network Intrusion Detection System designed to monitor and analyze network traffic. It utilizes Deep Neural Networks to detect malicious attacks by identifying abnormal patterns and generating alerts for potential threats such as unauthorized access, data exfiltration, and various types of Denial of Service attacks.
- Packet Capture: Continuously monitors live network traffic on the host's network.
- Deep Packet Inspection: Analyzes captured packets for detailed information, including IP addresses, ports, protocols, and more.
- Traffic Logging: Stores logs of network traffic for future analysis or forensic investigations.
- Anomaly-Based Detection: Utilizes machine learning to detect abnormal behavior in network traffic that deviates from baseline patterns (e.g., unusual data transfer volumes).
- Real-Time Alerts: Generates alerts when suspicious activity is detected.
- Threat Classification: Classifies detected intrusions by severity (low, medium, high), based on the type and potential impact of the threat.
- Incident Reporting: Automatically generates reports on detected threats, including time of detection, type of threat, and affected network segment.
- Service Isolation: Each service within NIDS (e.g., packet capture, logging, detection engine) runs in its own container, reducing the risk of cross-service vulnerabilities and ensuring potential security issues in one service don't affect others.
- Secure Service Networking: Docker’s virtualized networking stack ensures secure communication between NIDS components without directly exposing them to the host network.
- Enhanced Security: Docker’s containerization limits exposure by isolating services from the host system and one another, reducing the overall attack surface.
- Portability: Docker ensures NIDS can be deployed consistently across different environments, maintaining uniform behavior and configuration.
- Traffic Visualizations: Provides real-time visualizations of network traffic, including traffic flow, volume by protocol, and geographic source of traffic.
- Threat Maps: Displays an interactive threat map showing the source and destination of potential attacks, along with their severity.
- Historical Analysis: Allows users to view historical trends in network traffic and threats, with filtering options by time, location, or severity.
- REST API: Exposes functionality through an API, enabling external systems to retrieve traffic logs
- Custom Integration: Provides flexibility for security teams to integrate with other enterprise systems (e.g., firewalls, intrusion prevention systems) and customize response actions and alerts.
- Casey Bramlett: Front End Lead
- Isaiah Harville:
- Technical Lead
- Machine Learning Specialist
- Jacob Neel: Back End Developer
- Kevin Santschi: Back End Developer