Machine-Learning IDS/IPS · Hacking Project

Detect and optionally block known and novel network intrusions using supervised and anomaly-based machine learning with low false-positive rates.

**The problem**
Signature-based intrusion detection systems miss novel, obfuscated, and zero-day network attacks because they only match known patterns, while purely rule-based systems generate high false-positive rates. Modern encrypted and high-volume traffic further degrades traditional inspection. Enterprises need adaptive detection that learns normal network behavior and flags anomalous or malicious flows without constant signature updates.

**What you'll build**
Build an ML-driven intrusion detection/prevention system that extracts flow-level and packet features from network telemetry and applies supervised classifiers (for known attack families) plus unsupervised anomaly detection (for novel behavior) to score traffic in near real time. Train and validate on standard benchmark datasets (CIC-IDS2017/2018, UNSW-NB15) and a live capture lab, then wire the model into an inline enforcement path (or IDS mode) that can alert or drop malicious flows and map detections to MITRE ATT&CK. Address model drift and adversarial evasion with retraining pipelines and robustness testing.

**Objective** — Detect and optionally block known and novel network intrusions using supervised and anomaly-based machine learning with low false-positive rates.

**Expected outcome** — A trained ML IDS/IPS pipeline with a live packet-capture demo, evaluation metrics (precision/recall/ROC) on benchmark datasets, and detections surfaced in a dashboard mapped to ATT&CK techniques.

**Difficulty** — Advanced — combines network-traffic feature engineering, ML model selection, real-time streaming, and adversarial-robustness concerns; inline IPS enforcement raises the bar further.

**Primary category** — Network Security / Detection Engineering; Secondary = AI/ML Security, Threat Hunting, SOC

**Security domains** — Primary = Blue Team; Secondary = AI Security, Security Research, Network Security, DevSecOps

**Technical focus** — intrusion detection, network flow analysis, feature engineering (NetFlow/PCAP), supervised classification, unsupervised anomaly detection, real-time streaming inference, adversarial ML robustness, model drift/retraining, ATT&CK mapping

**Core technologies** — Languages: Python, C/Go (for high-throughput capture); Frameworks/Libraries: scikit-learn, XGBoost, PyTorch/TensorFlow, Scapy, CICFlowMeter, pandas; Security Tools: Suricata/Snort/Zeek (baseline + feature source), Wireshark; Cloud/Infra: Docker, Kafka/streaming, Kubernetes, network TAP/SPAN; AI/Data: CIC-IDS2017/2018, UNSW-NB15, NSL-KDD datasets, feature stores; Databases: Elasticsearch, ClickHouse/TimescaleDB

**Where it's valued** — Telecoms and ISPs, critical infrastructure/OT, cloud providers, enterprise network security teams, NDR/IDS product vendors

**Careers it builds toward** — Network Security Engineer, Detection Engineer, ML Security Engineer, Security Data Scientist, Threat Hunter

**Framework alignment**
• MITRE ATT&CK: Command and Control (T1071 Application Layer Protocol, T1573 Encrypted Channel), Exfiltration (T1041), Lateral Movement, Discovery (T1046 Network Service Discovery), Reconnaissance (T1595 Active Scanning)
• NIST CSF 2.0: Detect (anomalies and events, continuous security monitoring), Protect (network protective technology in IPS mode), Respond (mitigation)
• OWASP: N/A (network-layer focus) — API Top 10 only if inspecting API traffic
• CIS Controls v8: Control 13 Network Monitoring and Defense, Control 12 Network Infrastructure Management, Control 8 Audit Log Management
• MITRE ATLAS: relevant if defending against adversarial evasion of the ML model itself (AML.T0043 Craft Adversarial Data, AML.T0015 Evade ML Model)

**Innovation** — Improved Existing Solution — ML-based NDR is a mature commercial space (Darktrace, Vectra), so novelty is limited, but it is an excellent skills-building project with adversarial-robustness angles that can elevate it toward research. Scores: Innovation 6/10, Startup 6/10, Enterprise-Readiness 6/10, Patent = No.