System Requirements Document

Introduction

This document outlines the system requirements for the development of a Network Traffic Monitoring and Intrusion Detection System (IDS) using machine learning. The system is intended for deployment on a single Windows laptop and is designed to be a practical, demonstrable, and academically defensible final-year project for Computer Science/Information Technology students.

System Overview

The system will capture and analyze network traffic in real-time, detect suspicious activities using both rule-based and machine-learning techniques, and provide a web-based dashboard for monitoring and managing alerts. It will be implemented using Python and various supporting technologies, ensuring it is executable on a single laptop without the need for multiple servers.

Functional Requirements

As a user, I want to:

1. Capture network packets from the laptop's network interface.
2. Extract useful network traffic features for analysis.
3. Monitor network traffic in near real-time.
4. Detect suspicious or potentially malicious traffic.
5. Classify traffic as normal or suspicious/malicious.
6. Generate security alerts for detected anomalies.
7. Record detected events in a database for future reference.
8. View network activity through a modern web dashboard.
9. Access statistics and visualizations of network traffic.
10. Investigate detected events through the dashboard.
11. Simulate controlled cybersecurity attacks in a safe environment.

As a developer, I want to:

12. Use Python 3.11 and Flask for backend development.
13. Implement real-time dashboard updates using Flask-SocketIO.
14. Capture network traffic using Scapy and Npcap on Windows.
15. Process data using Pandas and NumPy.
16. Implement machine learning models using Scikit-learn.
17. Use SQLite for database operations with optional MySQL support.
18. Develop the frontend using HTML, Bootstrap 5, JavaScript, and Chart.js.
19. Structure the application with modular Python components.
20. Implement real-time packet capture with an interface-selection mechanism.
21. Extract detailed traffic features for analysis.
22. Implement rule-based detection for common suspicious behaviors.
23. Develop a machine-learning component for traffic classification.
24. Train and evaluate machine learning models using public datasets.
25. Integrate the trained model into the live monitoring system.
26. Manage alerts with detailed information and severity levels.
27. Create a professional cybersecurity dashboard with real-time updates.
28. Provide an alert-management page for administrators.
29. Develop a traffic analysis page with detailed network statistics.
30. Implement a machine learning page for dataset management and model training.
31. Provide monitoring controls for starting, stopping, and configuring detection modes.
32. Implement administrator authentication with secure practices.
33. Create a configuration system for managing application settings.
34. Ensure a safe testing environment for cybersecurity simulations.
35. Optimize performance for a normal student laptop.
36. Maintain a clear project directory structure.
37. Design a modern, responsive user interface.
38. Implement comprehensive logging and error handling.
39. Develop automated and manual testing procedures.
40. Provide detailed documentation for installation, usage, and troubleshooting.

User Personas

1. Administrator: A user responsible for configuring the system, monitoring network traffic, managing alerts, and conducting cybersecurity simulations.
2. Developer: A user involved in the development, testing, and maintenance of the IDS application.

Core User Flows

1. Administrator Monitoring Flow:

   • Log in to the dashboard.
   • Select the network interface for monitoring.
   • Start real-time traffic monitoring.
   • View live traffic data and alerts on the dashboard.
   • Investigate and manage alerts.
   • Stop monitoring when necessary.

2. Developer Setup and Testing Flow:

   • Set up the development environment.
   • Implement and test individual modules.
   • Conduct integration testing.
   • Document the system and provide installation instructions.

Visuals Colors and Theme

• Use a dark cybersecurity-style interface with a responsive Bootstrap layout.
• Incorporate sidebar navigation, dashboard cards, charts, tables, and modals.

Signature Design Concept

• A modern cybersecurity monitoring platform with a clean and professional look.

Interaction Model & Motion Direction

• Minimal animations to ensure usability on a laptop screen.
• Real-time updates using Flask-SocketIO for dynamic content.

Non-Functional Requirements

• The system must be performant on a single Windows laptop.
• Ensure secure authentication and data handling practices.
• Maintain modularity and separation of concerns in the codebase.

Tech Stack

• Backend: Python 3.11, Flask, Flask-SocketIO
• Network Monitoring: Scapy, Npcap
• Data Processing: Pandas, NumPy
• Machine Learning: Scikit-learn
• Database: SQLite (with optional MySQL support)
• Frontend: HTML, Bootstrap 5, JavaScript, Chart.js

Assumptions and Constraints

• The application must run on a single Windows laptop.
• All attack simulations must be conducted in a controlled environment.
• The system should not attempt to process unlimited traffic.

Glossary

• IDS: Intrusion Detection System
• ML: Machine Learning
• SQL: Structured Query Language
• ROC-AUC: Receiver Operating Characteristic - Area Under Curve
• ICMP: Internet Control Message Protocol
• SYN: Synchronize Packet in TCP/IP
• TTL: Time to Live

This document serves as a comprehensive guide for the development and implementation of the Network Traffic Monitoring and Intrusion Detection System, ensuring all requirements are met for a successful final-year project.