Building an AI intrusion detection pipeline
- Security
- Python
- ML
Most intrusion detection demos stop at a notebook. I wanted something that watches a live interface, scores traffic as it arrives, and shows the result on a dashboard a human can read at a glance.
Capture and features
Scapy sniffs packets and groups them into flows. For each flow I compute a handful of cheap features: packet count, byte volume, mean inter-arrival time, flag ratios and port entropy. Cheap matters, because feature extraction sits on the hot path.
Scoring
A small TensorFlow model trained on labelled flow data returns an anomaly score between 0 and 1. Rather than hard-alerting at a fixed threshold, the dashboard shows a rolling score and flags flows that stay above the line for several windows, which cuts noisy one-off spikes.
What I would do differently
Keep capture and scoring in separate processes from day one. Dropped packets under load were the first real bug, and a queue between the two stages fixed it faster than any model tweak.