Active Final Year Projects Showcase

Modern computer networks face continuous threats from malware, unauthorized access, and zero-day attacks that traditional signature-based security tools often fail to detect. These systems depend heavily on known attack patterns, which makes them less effective against new or evolving intrusions. The growing scale and complexity of network traffic also create a need for intelligent security solutions that can analyze traffic in real time and detect suspicious activity with high accuracy. This project proposes Intrusion Guard, a real-time intrusion detection system that uses machine learning to classify network traffic as normal or malicious. The system is designed for cybersecurity monitoring in environments where fast and accurate threat detection is critical, such as enterprise networks, laboratories, and institutional systems. It combines supervised and unsupervised learning to improve both known-attack detection and anomaly detection, making it more adaptable than conventional rule-based systems. The technical approach uses a hybrid model built around Random Forest for supervised classification and Isolation Forest for anomaly detection. The system processes network traffic data, extracts relevant flow-based features, and applies trained models to generate predictions in real time. To improve transparency and trust, the system also includes explainable AI output so users can understand why traffic is flagged as suspicious. The expected outcome is a practical and scalable intrusion detection solution that improves threat visibility, supports early warning, and strengthens network defense against both known and unknown attacks.

The primary target users are network administrators, cybersecurity analysts, and incident response teams responsible for intrusion monitoring, analysis, and response.

Functional Requirements:
FR-01: Network Traffic Monitoring — The system shall continuously monitor incoming and outgoing network traffic.
FR-02: Data Preprocessing — The system shall preprocess captured data before feeding it to machine learning models.
FR-03: Hybrid Intrusion Detection — The system shall detect intrusions using a hybrid machine learning model.
FR-04: Alert Generation — The system shall generate alerts when malicious activity is detected.
FR-05: Dashboard Visualization — The system shall provide a web-based dashboard for monitoring.
FR-06: Explainable AI (SHAP) — The system shall explain predictions using SHAP values.
FR-07: Geo-IP Visualization — The system shall display attacker locations geographically.
FR-08: Attack Injection Module — The system shall allow simulation of attacks.
FR-09: Data Storage & Logging — The system shall store logs of traffic and detections.
FR-10: Admin Control Panel — The system shall allow administrators to manage and review system activity.
FR-11: Threshold Adjustment — The system shall allow dynamic adjustment of detection thresholds.
FR-12: Real-Time Communication — The system shall support real-time data transfer between backend and frontend.
FR-13: Model Management — The system shall manage machine learning models.

NFR-01: Performance — The system shall process and classify network traffic in real time with minimal latency. The system shall handle large datasets efficiently. The system shall support continuous monitoring without performance degradation.
NFR-02: Accuracy — The system shall maintain high detection accuracy. The system shall ensure high precision and recall to minimize false positives and false negatives. The system shall consistently perform well on unseen data.
NFR-03: Scalability — The system shall support increasing volumes of network traffic without significant performance loss. The system shall be scalable to handle multiple network sources in future. The architecture shall allow easy integration of new machine learning models.
NFR-04: Reliability — The system shall operate continuously with minimal downtime. The system shall ensure stable performance under high traffic conditions. The system shall recover gracefully from failures or crashes.
NFR-05: Security — The system shall ensure secure handling of network data. The system shall restrict unauthorized access to the dashboard and system controls. The system shall protect stored logs and model data from unauthorized modification. The system shall use secure communication protocols where applicable.
NFR-06: Usability — The system shall provide a user-friendly web interface. The dashboard shall be easy to navigate and understand. The system shall present alerts and reports in a clear and readable format.
NFR-07: Maintainability — The system shall be modular to allow easy updates and debugging. The codebase shall be well-structured and documented. The system shall support easy model retraining and updates.
NFR-08: Availability — The system shall be available 24/7 for monitoring network activity. The system shall minimize downtime during updates or maintenance.
NFR-09: Compatibility — The system shall run on standard operating systems. The system shall be accessible through modern web browsers. The system shall support integration with standard Python libraries and tools.
NFR-10: Real-Time Communication Efficiency — The system shall ensure low-latency communication between backend and frontend. The system shall update the dashboard instantly upon detection events.
NFR-11: Data Integrity — The system shall ensure that stored data is accurate and consistent. The system shall prevent data loss during processing or storage.
NFR-12: Extensibility — The system shall allow future enhancements such as new attack detection techniques, additional visualization modules, and integration with external security tools.