PROJECT / MACHINE LEARNING / NETWORK SECURITY
NetShield — Network Anomaly Detection.
NetShield explores the practical challenges of network anomaly detection using CIC-IDS-2017. Its primary runnable experience is a Flask application for analyzing flow CSVs and PCAP/PCAPNG captures, classifying flows with a scikit-learn Random Forest, and monitoring incoming events through a Flask-SocketIO dashboard. The repository also includes SQLite-backed flow history, feature-name normalization, optional AbuseIPDB enrichment, model evaluation utilities, and a separate experimental Go capture prototype.
WHAT IT DOES
- Analyze CSV, PCAP, and PCAPNG traffic through the web interface.
- Inspect live-flow events, capture status, and persisted flow statistics.
- Evaluate training pipelines with dataset audits, baselines, and offline SHAP analysis.
- Normalize capture-tool feature names and report unmapped fields for diagnosis.
TECHNOLOGIES
PythonFlaskscikit-learnFlask-SocketIOSQLitePyFlowMeterGopytest