Application of ML for Intrusion Detection System

My collection of research for application of Machine Learning Technologies for implementing Intrusion Detection Systems. The goal of this research is to experiment with different approaches and patterns and apply different models potentially making the detection to either have a better accuracy and/or implement a much faster approach when detecting network anomalies.

The dataset used in this research is called NSL-KDD, which is an updated version of KDD'99 dataset, which presented problems when it comes to redundancy. The researchers from University of New Brunswick solved the issues by creating new subset of this dataset.

A more detailed explanation of their improvements can be found here.

Note: Although the dataset was last updated seven (7) years ago, my main goal from this research is only to experiment (with intersection between machine learning & cybersecurity) and a refresher for me in this area as a computer scientist.

2026-07-04.22-02-09.mp4

Experiment Setup

To install the dataset from kaggle and extract, simply execute the following:

# pulls the dataset from kaggle to the experiments folder
cd experiments
curl -L -o ./dataset/nslkdd.zip \
  https://www.kaggle.com/api/v1/datasets/download/hassan06/nslkdd

# unzip the dataset contents
cd dataset/ && unzip nslkdd.zip && rm -rf nsl-kdd/

or simply run the experiment-setup.sh script through:

bash experiment-setup.sh

This will pull the dataset from kaggle and extracts the contents of nsl-kdd dataset to the dataset folder.

Application Setup

The application consists of a FastAPI backend (which runs Scapy packet sniffing logic and the ML model prediction) and a React/TypeScript frontend dashboard.

Prerequisites

• Python 3.10+
• Node.js 18+
• root privileges (scapy requires raw socket access to capture packets)

Backend Setup

1. Navigate to the backend directory:

   cd src/backend

2. Create and activate a virtual environment:

   python3 -m venv .env
   source .env/bin/activate

3. Install the dependencies:

   pip install -r requirements.txt

4. Run database migrations:

   alembic upgrade head

5. Run the server (must be run as root for packet capture):

   sudo $(which python) main.py

The backend API will start at http://localhost:8080.

Frontend Setup

1. Navigate to the frontend directory:

   cd src/frontend

2. Install the node modules:

   npm install

3. Start the Vite development server:

   npm run dev

The frontend dashboard will be available at http://localhost:5173.