The Intrusion Detection System (IDS) is a high-performance network security platform engineered to inspect live packet streams, apply stateful heuristic threat detection algorithms, and deliver real-time security alerts to a modern browser dashboard with sub-50ms latency.
By interfacing directly with the host machine's Network Interface Card (NIC) via native C-bindings (Pcap4j / Npcap), the backend sniffs OSI Layer 3 (IPv4) and Layer 4 (TCP/UDP/ICMP) packets. Identified threats are persisted to a MySQL database for forensic auditing and simultaneously broadcasted to a React 18 frontend over STOMP WebSockets.
✨ Key Portfolio Highlights
⚡ Zero-Latency Real-Time Alerting: Uses STOMP over WebSockets to stream security alerts from packet capture to browser rendering in $< 50\text{ms}$.
🔍 Low-Level Bitwise Protocol Parsing: Performs deep header analysis (TCP flags bitwise masking) to detect stealth reconnaissance techniques like Xmas Scans, Null Scans, and rapid SYN Scans.
🧪 Built-In Attack Injection Simulator: Includes an embedded attack simulation engine allowing operators to inject synthetic threat vectors (DDoS Floods, Port Sweeps, DB Breaches) via REST endpoints or the UI dashboard for testing and demonstrations.
📊 Interactive Security Operations Dashboard: Built with React 18, Vite, and Recharts, featuring animated key metrics, live scrolling alert logs, search/filtering by severity, and temporal activity graphs.
🗄️ Persistent Event Auditing: Asynchronous database persistence layer powered by Spring Data JPA & Hibernate to log security events without blocking high-throughput packet processing.
🏗️ System Architecture & Data Pipeline
The system uses a decoupled Producer-Processor-Consumer pipeline:
Packet Capture (Producer): Native thread hooks into the host NIC using Pcap4j/Npcap, wrapping raw byte streams into structured PacketData domain models.
Detection Engine (Processor): Evaluates PacketData across a chain of modular Detector implementations using stateful rolling windows and TCP flag inspection.
Alert Broadcasting (Consumer): Triggered AlertEvent objects are dispatched concurrently—asynchronously saved to MySQL and published via WebSocket /topic/alerts.
Operations Dashboard (Presentation): React frontend consumes WebSocket frames to render dynamic threat counters, temporal distribution charts, and filterable log feeds.
🛡️ Threat Detectors Implemented
Detector Engine
Logic & Algorithm
Trigger Condition
Severity Level
SYN Sweep Detector
Stateful sliding temporal window tracking unique target ports per source IP. Bitwise flag check: tcpFlags == SYN.
$> 15$ unique ports accessed within rolling $10\text{s}$ window.
HIGH / CRITICAL
Stealth Scan Detector
Inspects TCP control flag combinations for illegal states.<br>• Null Scan: No flags set (0x00).<br>• Xmas Scan:FIN, PSH, URG all set (0x29).
Packet header matches illegal TCP flag mask.
CRITICAL
ICMP Flood Detector
Monitors rolling ICMP echo request frequencies per source IP.
$> 50$ ICMP packets within rolling $10\text{s}$ window.
HIGH
Risky Port Detector
Flags connection attempts targeting sensitive or vulnerable service ports (e.g. 22/SSH, 23/Telnet, 3389/RDP, 3306/MySQL).
