DESIGN AND IMPLEMENTATION OF A NETWORK INTRUSION DETECTION SYSTEM (NIDS)

CHAPTER ONE: INTRODUCTION
1.1 Background of the Study
With the exponential growth of internet connectivity and digital transformation, organizations and individuals face an unprecedented rise in cyber threats. Traditional perimeter security mechanisms, such as firewalls, are no longer sufficient because attackers frequently bypass them using sophisticated application-layer vulnerabilities, zero-day exploits, and insider threats.
A Network Intrusion Detection System (NIDS) serves as a critical second line of defense. It monitors network traffic in real-time, inspects packet headers and payloads, and flags suspicious patterns or malicious activities that indicate an ongoing cyber attack, such as port scans, Denial-of-Service (DoS) attacks, or unauthorized data exfiltration.
1.2 Statement of the Problem
Many small-to-medium enterprises (SMEs) lack robust security monitoring because commercial NIDS solutions are expensive, complex to configure, and resource-intensive. Furthermore, existing open-source solutions often suffer from high rates of false positives or struggle to detect novel, signature-less attacks in real-time. This project addresses these gaps by designing a lightweight, efficient, and customizable NIDS capable of capturing network traffic and identifying malicious signatures and anomalous behavior.
1.3 Aim and Objectives
The aim of this project is to design and implement a functional Network Intrusion Detection System. Specific objectives are to:
• Review existing literature and methodologies used in network intrusion detection.
• Analyze system requirements (functional and non-functional) for real-time packet capture and analysis.
• Design a modular NIDS architecture comprising a packet capture engine, a detection/matching engine, and an alert logging database.
• Implement the system using Python and the Scapy packet manipulation library.
• Test and evaluate the system's performance against simulated network attacks (e.g., port scanning and SYN flooding).
1.4 Significance of the Study
• For Network Administrators: Provides a cost-effective, transparent tool for real-time threat visibility.
• For Security Researchers: Serves as a foundational prototype that can be extended with machine learning models for anomaly detection.
• Academic Value: Demonstrates the practical application of network protocols, socket programming, and signature matching algorithms.
1.5 Scope and Limitations
• Scope: The system focuses on monitoring Ethernet/IP/TCP/UDP traffic on a local network interface, matching packets against a defined signature rule set, and logging alerts to a database.
• Limitations: Encrypted traffic (HTTPS/TLS) limits deep packet inspection (DPI) payload visibility without a man-in-the-middle decryption proxy. High-speed enterprise networks (10 Gbps+) may cause packet dropping on standard hardware.
CHAPTER TWO: LITERATURE REVIEW
2.1 Conceptual Framework
An Intrusion Detection System (IDS) is classified based on its placement and detection methodology:
1. Placement:
o HIDS (Host-based IDS): Monitors internal system events, logs, and file integrity on a single host.
o NIDS (Network-based IDS): Placed at strategic points in the network to monitor traffic flowing across multiple systems.
2. Detection Methodology:
o Signature-Based Detection: Compares network traffic against a database of known attack signatures (similar to antivirus software). Highly accurate for known threats but blind to zero-day attacks.
o Anomaly-Based Detection: Establishes a baseline of "normal" network behavior and flags statistical deviations. Effective against novel attacks but prone to higher false-positive rates.

    Date: 2026-09-11 00:00:00.000000