Network IDS/IPS (NIDS/NIPS) · Hacking Project

Build and tune a network intrusion detection/prevention sensor that reliably alerts on and blocks known and anomalous malicious traffic.

**The problem**
Most home and SMB networks have no visibility into lateral movement, exploitation attempts, or command-and-control traffic crossing the wire — perimeter firewalls only enforce port/IP rules and are blind to the content and behavior of allowed flows. Without signature- and anomaly-based inspection, intrusions like exploit delivery, port scans, and beaconing go undetected until damage is done. Analysts need a sensor that both alerts on (IDS) and actively blocks (IPS) malicious packets in line.

**What you'll build**
Deploy an enterprise-grade detection stack (Suricata or Snort 3, optionally Zeek for protocol metadata) either as a passive tap/SPAN-port IDS or an inline IPS bridge. Tune rulesets (ET Open / Talos), write custom rules for lab-specific threats, and forward EVE JSON alerts to a SIEM/dashboard for triage. Validate coverage by replaying attack PCAPs and live-testing against a red-team VM.

**Objective** — Build and tune a network intrusion detection/prevention sensor that reliably alerts on and blocks known and anomalous malicious traffic.

**Expected outcome** — A working Suricata/Snort deployment with a documented custom ruleset, a tuning/false-positive report, and dashboards showing detections mapped to attacker behavior.

**Difficulty** — Intermediate — requires networking (spanning/bridging), rule syntax, and tuning judgment beyond a pure beginner install.

**Primary category** — SOC / Network Security Monitoring; Secondary = Threat Hunting, Detection Engineering

**Security domains** — Primary = Blue Team; Secondary = Purple Team, Incident Response, Threat Intelligence, Security Research

**Technical focus** — Signature-based detection, anomaly detection, packet inspection (DPI), rule writing, IDS tuning/false-positive management, protocol analysis, inline prevention, network tap/SPAN design, PCAP replay

**Core technologies** — Languages: Bash, Python (rule/log automation), YAML; Frameworks/Libraries: Suricata rule language, Snort 3, Zeek scripting; Security Tools: Suricata, Snort, Zeek, ET Open rules, tcpreplay, Wireshark, Scapy; Cloud/Infra: Linux (bridge/netfilter, PF_RING/AF_PACKET), VM lab, SPAN/tap or virtual switch; AI/Data: EVE JSON, optional ML anomaly scoring; Databases: Elasticsearch/OpenSearch, SQLite for rule metadata

**Where it's valued** — Managed security services (MSSP), finance, healthcare, critical infrastructure, telecom, any enterprise SOC

**Careers it builds toward** — SOC Analyst (Tier 1–2), Detection Engineer, Network Security Engineer, Threat Hunter, IDS/IPS Specialist

**Framework alignment**
• MITRE ATT&CK: Detects Exploitation of Remote Services (T1210), Network Service Discovery (T1046), Command and Control channels (T1071 Application Layer Protocol, T1571 Non-Standard Port), Exfiltration Over C2 Channel (T1041), Lateral Tool Transfer (T1570)
• NIST CSF 2.0: Detect (DE.CM continuous monitoring, DE.AE anomalies/events), Protect (PR.IR for inline blocking), Respond (RS.AN analysis)
• OWASP: N/A (network-layer); indirectly aids detection of API Top 10 exploit traffic
• CIS Controls v8: 13 (Network Monitoring and Defense), 8 (Audit Log Management), 4 (Secure Configuration)

**Innovation** — Improved Existing Solution — IDS/IPS is a mature category, but custom rule development and detection tuning make it a strong portfolio piece rather than a novel product. Scores: Innovation 4/10, Startup 3/10, Enterprise-Readiness 8/10, Patent = No.