A comprehensive AI-powered Intrusion Detection and Prevention System with real-time threat monitoring, machine learning-based anomaly detection, and automated response capabilities.🔒 Complete AI-Powered Security Solution
-
Real-time Threat Detection - Continuous monitoring with intelligent alert generation
-
🔍 Real-time Network Monitoring: Powered by Suricata IDS 7.0- AI-Powered Analysis - Smart threat scoring and pattern recognition
-
🤖 AI-Based Threat Detection: Machine learning anomaly detection- Automated Response - Intelligent IP blocking and threat mitigation
-
🌍 Geolocation Intelligence: IP-based threat analysis- Geographic Intelligence - Global threat visualization and analysis
-
⚡ Automated Response: Instant threat mitigation- System Health Monitoring - Resource usage and performance tracking
-
📊 Interactive Dashboard: Real-time monitoring and analytics
-
🔧 Microservices Architecture: Scalable and maintainable### 📊 Dashboard & Analytics
-
📈 Advanced Analytics: Comprehensive reporting and statistics
-
Professional Interface - Clean, intuitive multi-page dashboard
- Threat Analytics - Comprehensive threat trend analysis
Enterprise AI-IDPS/- **Visual Threat Map** - Geographic distribution of security threats
├── 🎨 Frontend/ # React.js Dashboard
│ ├── Dashboard Overview # System status & metrics### 🛡️ Security Management
│ ├── Alert Management # Real-time threat alerts
│ ├── Suricata IDS Control # Network monitoring- **Alert Management** - Detailed view with filtering and pagination
│ ├── Blocked IP Management # IP blocking & filtering- **IP Blocking** - Manual and automatic IP address blocking
│ ├── System Health Monitor # Service status- **Severity Classification** - Critical, High, Medium, Low threat levels
│ └── Reports & Analytics # Detailed insights- **Historical Tracking** - Complete audit trail of security events
│
├── ⚙️ Backend/ # Python Flask Microservices### 🔧 Technical Features
│ ├── Main API Server # Core application logic
│ ├── Suricata Service # IDS integration- **Modern Tech Stack** - React.js, Flask, SQLite, Tailwind CSS
│ ├── AI/ML Detection Engine # Machine learning- **RESTful API** - Well-structured backend with comprehensive endpoints
│ ├── Threat Intelligence # External threat feeds- **Responsive Design** - Works seamlessly on desktop and mobile
│ ├── GeoIP Service # Location analysis- **Real-time Updates** - Live data refresh without page reload
│ ├── Network Monitor # Traffic analysis- **Exportable Data** - CSV/text export for further analysis
│ └── Automated Response # Threat mitigation
│## 🏗️ Architecture
├── 💾 Data Layer/ # SQLite Databases
│ ├── Alerts Database # Security incidents```
│ ├── Blocked IPs Database # IP blocking recordsmini-ai-idps/
│ └── Service Databases # System data├── 🎨 frontend/ # React.js frontend application
││ ├── src/components/ # UI components (Dashboard, Alerts, etc.)
└── 🧠 AI Models/ # Machine Learning│ ├── src/services/ # API and WebSocket services
├── Anomaly Detection # Unsupervised learning│ └── public/ # Static assets
├── Threat Classification # Supervised learning├── ⚙️ backend/ # Flask backend API
└── Pattern Recognition # Deep learning│ ├── app.py # Main application server
```│ ├── models/ # Data models and ML components
│ └── utils/ # Utilities (email, reports, data generation)
## 🚀 Quick Start Guide├── 💾 data/ # SQLite databases and sample data
└── 📚 docs/ # Documentation and demo guides
### Prerequisites```
Before starting, ensure you have:## 🚀 Quick Start
- **Python 3.8+** ([Download](https://python.org/downloads/))### Prerequisites
- **Node.js 16+** ([Download](https://nodejs.org/))
- **Suricata IDS 7.0** (Optional - system works with built-in simulation)- Python 3.8+
- **Windows 10/11** or **Linux** environment- Node.js 16+
- npm/yarn
### 📦 Installation Steps
### Backend Setup
#### 1. Clone or Download the Project
```bash
```bash# Install dependencies
# If using Gitpip install -r requirements.txt
git clone <repository-url>
cd mini-ai-idps# Start backend server
python run.py
# Or download and extract the project zip file```
Backend runs on http://localhost:5000
# Navigate to project root```bash
cd mini-ai-idps# Navigate to frontend
cd frontend
# Install Python dependencies
pip install -r requirements.txt# Install dependencies
npm install
# Note: If some packages fail, the system has fallback implementations
```# Start development server
npm start
#### 3. Frontend Setup (React Dashboard)```
```bashFrontend runs on `http://localhost:3000`
# Navigate to frontend directory
cd frontend## 💡 Demo Highlights
# Install Node.js dependenciesPerfect for college project presentations:
npm install
1. **Professional Interface** - Enterprise-grade UI/UX design
# Return to project root2. **Real-time Monitoring** - Live threat detection and system monitoring
cd ..3. **AI Integration** - Intelligent threat analysis and automated responses
```4. **Comprehensive Analytics** - Detailed reports and threat visualization
5. **Interactive Features** - Manual IP blocking, filtering, data export
#### 4. Database Initialization
## 🛠️ Technology Stack
The databases will be automatically created when you first run the services. No manual setup required!
- **Frontend:** React.js 18, React Router, Tailwind CSS, Axios
## 🎯 How to Start the System- **Backend:** Flask 2.3, Flask-CORS, SQLite3
- **Monitoring:** psutil for system metrics
### Method 1: Quick Start (Recommended)- **Reporting:** ReportLab for PDF generation
- **Data:** Realistic synthetic threat data generator
**Start Backend Services:**
```bash## 📈 Key Metrics Tracked
# Terminal 1: Main API Server
python run.py- Total security alerts and incidents
```- High-priority threat count
- Blocked vs. allowed traffic
```bash- Geographic threat distribution
# Terminal 2: Suricata IDS Service- System resource utilization
cd backend- ML model accuracy and performance
python suricata_service.py
```## 🔒 Security Features
```bash- **Multi-layer Detection** - Network, application, and behavioral analysis
# Terminal 3: AI/ML Detection Service- **Automated Blocking** - Smart IP blacklisting based on threat severity
cd backend- **Real-time Alerting** - Instant notifications for critical threats
python ml_service.py- **Audit Trail** - Complete logging of all security events
```- **Manual Controls** - Administrative override capabilities
**Start Frontend Dashboard:**## 📊 Sample Data Included
```bash
# Terminal 4: React DashboardThe system includes realistic sample data for demonstration:
cd frontend
npm start- 50+ security alerts across multiple threat types
```- Geographic distribution from 10+ countries
- Various severity levels and response actions
### Method 2: Individual Service Management- System health metrics and performance data
Start each service in separate terminals for full control:## 🎯 Perfect For
```bash- **College Projects** - Demonstrates full-stack development skills
# Terminal 1: Main API Server (Port 5000)- **Security Courses** - Practical cybersecurity implementation
python run.py- **Hackathons** - Complete, functional security monitoring system
- **Portfolio** - Showcase enterprise-level development capabilities
# Terminal 2: Suricata Service (Port 5006)- **Learning** - Hands-on experience with security monitoring concepts
cd backend && python suricata_service.py
## 🚀 Future Enhancements
# Terminal 3: AI/ML Service (Port 5001)
cd backend && python ml_service.py- Machine learning model training with real data
- Integration with external threat intelligence feeds
# Terminal 4: Threat Intelligence (Port 5002)- Advanced visualization with charts and graphs
cd backend && python threat_intel_service.py- WebSocket real-time notifications
- Mobile app companion
# Terminal 5: GeoIP Service (Port 5003)- Docker containerization
cd backend && python geoip_service.py- Cloud deployment ready
# Terminal 6: Network Monitor (Port 5004)## 📝 Documentation
cd backend && python network_monitor_service.py
- [Setup Instructions](docs/setup.md) - Detailed installation guide
# Terminal 7: Automated Response (Port 5005)- [Demo Guide](docs/demo.md) - How to present the project
cd backend && python automated_response_service.py- [Features Overview](docs/features.md) - Complete feature list
# Terminal 8: Frontend Dashboard (Port 3000)## 🤝 Contributing
cd frontend && npm start
```This project is designed for educational purposes. Feel free to fork, modify, and enhance based on your requirements.
## 🌐 Access the System## 📄 License
Once all services are running, access your AI-IDPS system at:Open source - perfect for academic and learning purposes.
- **🎨 Main Dashboard**: http://localhost:3000---
- **⚙️ API Server**: http://localhost:5000
- **🔍 Suricata Control**: http://localhost:5006**Built with ❤️ for cybersecurity education and demonstration**
### Service Endpoints_Showcasing modern web development practices with real-world security monitoring capabilities_
| Service | Port | Purpose |
|---------|------|---------|
| Main API | 5000 | Core application logic |
| AI/ML Engine | 5001 | Machine learning detection |
| Threat Intel | 5002 | External threat feeds |
| GeoIP Service | 5003 | Location intelligence |
| Network Monitor | 5004 | Traffic analysis |
| Automated Response | 5005 | Threat mitigation |
| Suricata IDS | 5006 | Network intrusion detection |
| Frontend Dashboard | 3000 | Web interface |
## 🛡️ Suricata IDS Integration
### Using Real Suricata (Recommended)
If you have Suricata installed on your system:
1. **Windows**: Install Suricata from [official releases](https://suricata.io/download/)
2. **Linux**: `sudo apt install suricata` or `sudo yum install suricata`
3. The system will automatically detect and use your Suricata installation
### Simulation Mode
If Suricata is not installed, the system automatically runs in simulation mode with:
- Realistic threat alerts
- Network traffic simulation
- All dashboard features functional
## 📊 Dashboard Features
### 1. **Main Dashboard**
- System overview and health status
- Real-time alert feed
- Network statistics
- Threat level indicators
### 2. **Alert Management**
- Live security alerts
- Threat classification
- Geographic source tracking
- Alert filtering and search
### 3. **Suricata IDS Control**
- Start/stop network monitoring
- Rule management
- Live statistics
- Configuration controls
### 4. **Blocked IP Management**
- View blocked IP addresses
- Manual IP blocking/unblocking
- Geographic distribution
- Export functionality
### 5. **System Health**
- Service status monitoring
- Performance metrics
- Resource usage
- Service management
### 6. **Reports & Analytics**
- Threat trends
- Statistical analysis
- Historical data
- Export capabilities
## 🔧 Configuration
### Environment Variables
Create a `.env` file in the project root for custom configuration:
```env
# API Configuration
API_HOST=0.0.0.0
API_PORT=5000
DEBUG_MODE=True
# Database Configuration
DATABASE_PATH=./data/
SQLITE_TIMEOUT=30
# Suricata Configuration
SURICATA_CONFIG_PATH=C:/Program Files/Suricata/suricata.yaml
SURICATA_LOG_PATH=C:/Program Files/Suricata/log/
# AI/ML Configuration
ML_MODEL_PATH=./models/
ENABLE_ML_DETECTION=True
# External APIs (Optional)
VIRUSTOTAL_API_KEY=your_api_key_here
ABUSEIPDB_API_KEY=your_api_key_hereAdd custom detection rules in backend/rules/custom.rules:
# Custom AI-IDPS Rules
alert tcp any any -> any 80 (msg:"Suspicious HTTP Request"; content:"malware"; sid:1000001;)
alert tcp any any -> any 443 (msg:"SSL Anomaly Detected"; sid:1000002;)
pip install --upgrade pip
pip install -r requirements.txt --force-reinstall# Kill processes using the port (Windows)
netstat -ano | findstr :5000
taskkill /PID <process_id> /F
# Kill processes using the port (Linux)
lsof -ti:5000 | xargs kill -9cd frontend
rm -rf node_modules package-lock.json
npm install
npm start# Ensure write permissions to data directory
chmod 755 ./data/Check if services are running:
# Windows
netstat -an | findstr "5000 5001 5002 5003 5004 5005 5006 3000"
# Linux
netstat -tlnp | grep -E ":(5000|5001|5002|5003|5004|5005|5006|3000)"- Backend: Add new services in
/backend/ - Frontend: Add new components in
/frontend/src/components/ - Database: Modify schemas in service files
- AI Models: Add models in
/models/
Service logs are available at:
- Backend: Console output and service-specific logs
- Frontend: Browser console and npm logs
- Suricata:
C:/Program Files/Suricata/log/(if using real Suricata)
SQLite databases are stored in /data/:
alerts.db: Security alerts and incidentsblocked_ips.db: IP blocking records- Service-specific databases for each microservice
Minimum Requirements:
- RAM: 4GB
- CPU: Dual-core 2GHz
- Storage: 10GB free space
- Network: Stable internet connection
Recommended for Production:
- RAM: 8GB+
- CPU: Quad-core 3GHz+
- Storage: SSD with 50GB+ free space
- Network: High-speed connection
-
Database Optimization:
# Increase SQLite performance PRAGMA journal_mode = WAL; PRAGMA synchronous = NORMAL; PRAGMA cache_size = 10000;
-
Service Scaling:
- Run services on different servers
- Use load balancers for high traffic
- Implement Redis for session management
-
Network Optimization:
- Configure Suricata with optimal buffer sizes
- Use dedicated network interfaces for monitoring
- Implement traffic mirroring for production networks
For production environments:
- Use HTTPS: Configure SSL certificates
- Database Security: Use PostgreSQL or MySQL
- Authentication: Implement user management
- Monitoring: Add service monitoring (Prometheus/Grafana)
- Backup: Automated database backups
# Example Dockerfile for backend services
FROM python:3.9-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY backend/ .
EXPOSE 5000
CMD ["python", "app.py"]Main API (Port 5000):
GET /api/alerts # Get security alerts
GET /api/blocked_ips # Get blocked IP addresses
POST /api/block_ip # Block an IP address
GET /api/system/health # System health status
GET /api/statistics # System statistics
Suricata API (Port 5006):
GET /status # Suricata status
POST /start # Start monitoring
POST /stop # Stop monitoring
GET /alerts # Get IDS alerts
GET /statistics # Network statistics
- Documentation: Check this README first
- Issues: Common problems and solutions above
- Logs: Check console output for error details
- Community: Create issues for bugs or feature requests
- Fork the repository
- Create a feature branch
- Make your changes
- Test thoroughly
- Submit a pull request
This project is licensed under the MIT License - see the LICENSE file for details.
Your AI-IDPS system is working correctly when you see:
✅ All services start without errors ✅ Dashboard loads at http://localhost:3000 ✅ Real-time alerts appear in the dashboard ✅ Network statistics update continuously ✅ Suricata IDS shows "Running" status ✅ All 6 dashboard pages are accessible ✅ Service health shows green status
Your Enterprise AI-IDPS system is now ready to protect your network!
Next Steps:
- Start all services using the commands above
- Access the dashboard at http://localhost:3000
- Configure custom detection rules as needed
- Monitor your network for threats in real-time
Happy Monitoring! 🛡️