Net-Scan → Network Intrusion Detection System

Net-Scan is a machine-learning-powered Network Intrusion Detection System (NIDS) designed for educational and demonstration purposes. It processes network log CSV files, classifies traffic as normal or malicious, and provides interactive visual summaries via a Streamlit dashboard.

Overview

• Upload network log CSV files
• Preprocess and encode categorical features automatically
• Detect malicious traffic using a trained Random Forest model
• Visualize normal vs. attack traffic distribution
• Expand a detailed prediction table when needed

Features

• CSV Upload → Quickly load network logs
• Automatic Data Cleaning → Handles missing or inconsistent values
• Random Forest ML Detection → Pre-trained on NSL-KDD Dataset (filtered version of KDD)
• Minimal, User-Friendly Dashboard → Clean and distraction-free interface
• Traffic Highlighting → Easily identify risky connections

Tech Stack

• Python
• Streamlit → Interactive dashboard
• Scikit-learn → Machine learning
• Pandas / NumPy → Data processing
• Plotly → Interactive plots
• Joblib → Model serialization

Project Structure

├── data/                → Stores user-uploaded log CSV files and contains NSL-KDD Dataset  
├── demo/                → Sample log files for testing  
├── model/               → Trained Random Forest model + encoders  
├── scripts/             → Preprocessing, training, and detection scripts  
├── app.py               → Streamlit application entry point  
├── requirements.txt     → Python dependencies  
├── LICENSE              → MIT license  
└── README.md            → Project documentation 

Installation

# Clone the repository
git clone https://github.com/aqua-void/Net-Scan.git

# Navigate to the project directory
cd Net-Scan

# Create a virtual environment
python -m venv venv

# Activate the environment (Windows)
venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Run the Streamlit app
streamlit run app.py

Demo Logs

• To quickly test the dashboard, upload one of the sample network logs from the demo/ folder
• Ensure the CSV file format matches the training dataset

Usage

• Upload your network log CSV via the dashboard
• View the detection summary and attack trends
• Expand Detailed Predictions for deeper insights

Optional Script

• /scripts/preprocess.py → Encodes categorical features and prepares training data
• /scripts/train_forest.py → Trains the Random Forest model and generates .pkl encoder files
• /scripts/detect.py → Standalone detection script (optional, used internally)

Notes

• Keep the data/ folder for uploaded CSV logs
• Only CSV files matching the training dataset format are supported
• Pre-trained models are included in the model/ folder