< Back to projects

Python IDS/IPS

M1 SI Solo October 2025 Completed

Solo project (pyproject.toml author: "Mustapha HILALOGLU"). A homemade intrusion detection/prevention system in Python: live network packet capture, a signature-based detection engine, and automated PDF reporting with statistics and charts - built as a properly structured Python package rather than a single script.

Python IDS/IPS pipeline Packet capture Scapy Signature engine compiled regex - SQLi, XSS NLP enrichment spaCy / NLTK Reporting PDF, matplotlib/seaborn
Pipeline: Scapy captures traffic, a signature engine flags known attack patterns, an NLP layer enriches text-based indicators, and a reporting module produces PDF output with charts and statistics.

What was built

  • Packet capture with Scapy for live network traffic ingestion.
  • A signature-based detection engine using compiled regular expressions to flag SQL injection and XSS patterns in captured traffic.
  • Text analysis with NLP (spaCy/NLTK) to enrich detection beyond pure pattern matching.
  • Automated PDF report generation with reportlab, including statistics and charts built with matplotlib, seaborn and pandas.
  • A clean modular architecture (src/network, src/detection, src/reporting), a pytest unit test suite, and dependency management with Poetry.

The codebase totals roughly 2,955 lines of Python across the package.

Tech stack

Python Scapy spaCy / NLTK matplotlib / seaborn / pandas reportlab Poetry pytest

Status

Completed and submitted, packaged as a proper Python project with tests and documentation rather than a one-off script.

< All projects