NetVigil: An AI-Driven Adaptive Intrusion Prevention System (A-IPS)

NetVigil is an automated network security solution designed to protect enterprise infrastructures. It combines Machine Learning with Software-Defined Networking (SDN) principles to detect and mitigate DDoS attacks in real-time.

🏢 Business Case: Global Banking Infrastructure

This project simulates a security layer for a Global Bank with a Central Headquarter (HQ) and multiple remote Branch Offices.

• Scenario: A malicious actor at a remote Branch Office initiates a high-volume TCP/UDP/ICMP flood (DDoS) targeting the HQ's Transaction Server.
• The Risk: Without automation, banking services remain down until a human administrator manually identifies and blocks the attacker.
• The NetVigil Solution: Acting as an Adaptive IPS, NetVigil identifies the threat at the HQ's Gateway Router and automatically pushes a block-rule (ACL) to stop the attack at the source.

🛠️ System Architecture

1. Packet Sniffing: Uses Scapy to monitor live traffic at the HQ Gateway.
2. AI Analysis: A Random Forest model classifies traffic as Normal or Malicious.
3. Visualization: A Streamlit dashboard provides real-time traffic telemetry.
4. Active Mitigation: Upon detection, the script uses Netmiko to log into the Cisco Router and apply an Access Control List (ACL).

Tech Stack:

• Core: Python
• Network: Scapy (Sniffing) & Netmiko (Automation)
• AI/ML: Scikit-Learn (Random Forest Classifier)
• Frontend: Streamlit & Plotly
• Environment: GNS3 & Cisco IOS

🌐 Network Topology

• Victim (HQ): 192.168.1.10
• Gateway Router (R2): 192.168.1.1
• Attacker (Branch Office): 192.168.2.20

⚙️ Network Configuration (IP Addressing)

Victim PC Configuration:

Victim> ip 192.168.1.10 /24 192.168.1.1
Victim> show ip

Victim> save

Router R3 (Attacker_router) Configuration:

R3# conf t
R3(config)# interface fa0/0
R3(config-if)# ip address 192.168.2.20 255.255.255.0
R3(config-if)# no shutdown
R3(config-if)# exit
R3(config)# ip route 0.0.0.0 0.0.0.0 192.168.2.1
R3(config)# exit
R3# write memory

Router R1 (Branch Gateway) Configuration:

R1# conf t
R1(config)# interface fa0/0
R1(config-if)# ip address 192.168.2.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface serial 1/0
R1(config-if)# ip address 10.0.0.1 255.255.255.252
R1(config-if)# clock rate 64000
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ip route 192.168.1.0 255.255.255.0 10.0.0.2
R1(config)# exit
R1# write memory

Router R2 (HQ Gateway - Target of Mitigation):

R2# conf t
R2(config)# interface serial 1/0
R2(config-if)# ip address 10.0.0.2 255.255.255.252
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface fa0/0
R2(config-if)# ip address 192.168.1.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# ip route 192.168.2.0 255.255.255.0 10.0.0.1
R2(config)# exit
R2# write memory

Enable Telnet & Remote Management (R2)

R2# conf t
R2(config)# username admin privilege 15 secret cisco
R2(config)# line vty 0 4
R2(config-line)# login local
R2(config-line)# transport input telnet
R2(config-line)# exit
R2(config)# enable secret cisco

Automated Mitigation Logic (Block Commands)

R2# configure terminal
R2(config)# ip access-list extended BLOCK_LIST
R2(config-ext-nacl)# 5 deny ip host 192.168.2.20 any log
R2(config-ext-nacl)# 10 permit ip any any
R2(config-ext-nacl)# exit
R2(config)# interface Serial 1/0
R2(config-if)# ip access-group BLOCK_LIST in
R2(config-if)# exit
R2(config)# exit
R2# write memory

Manual Reset Command (To Restore Traffic)

To clear the block and restart the demo:

R2# configure terminal
R2(config)# interface Serial 1/0
R2(config-if)# no ip access-group BLOCK_LIST in
R2(config-if)# exit
R2(config)# no ip access-list extended BLOCK_LIST
R2(config)# exit
R2# write memory

🎥 Project Demo

Watch a short screen recording demonstrating NetVigil in action, including its key features and overall workflow.

NetVigil.Presentation.Video.mp4

🚀 Getting Started

📋 Prerequisites

• GNS3: Installed with Cisco IOS Image (e.g., c7200).
• Python: Version 3.10 or higher.
• Loopback Adapter: Microsoft KM-TEST Loopback Adapter for Cloud bridging.

📥 Installation

Clone the repository:

git clone [https://github.com/Smarth2005/NetVigil.git](https://github.com/Smarth2005/NetVigil.git)
cd NetVigil

Install dependencies:

pip install -r requirements.txt

⚡ Execution

• Launch AI Engine: python netvigil_core.py
• Start Dashboard: streamlit run dashboard.py
• Simulate Attack: From Attacker (Router R3) console: ping 192.168.1.10 repeat 100000

Securing the future of banking through automated, AI-driven network resilience.
Project Developed by: Smarth Kaushal