The vsosh44/ids repository is a lightweight Python-based Intrusion Detection System designed for small networks, written in Russian with the primary purpose of analyzing network traffic in real time to detect anomalies and block suspicious IP addresses. The system is classified across multiple cybersecurity domains including intrusion detection, network security, attack detection, anomaly detection, and machine learning-based threat identification, with specific focus on the NSL-KDD dataset domain.
The core functionality centers on detecting and mitigating four specific types of network attacks: SYN-Scan, TCP Flood, UDP Flood, and ICMP Flood. The detection mechanism operates through a five-step process that begins by intercepting incoming packets, then counts packets within a sliding window to establish traffic patterns. The system dynamically updates its detection threshold to adapt to normal traffic variations, performs IP reputation checks when thresholds are exceeded multiple times, and finally logs events and blocks identified addresses through firewall integration.
A key feature of this IDS is its adaptive threshold system with automatic adjustment based on incoming traffic patterns. Rather than using static detection rules, the system learns and adjusts its sensitivity to distinguish between normal traffic fluctuations and genuine attack patterns. Before blocking an IP address, the system performs an additional reputation check to reduce false positives, ensuring that only genuinely malicious sources are blocked. All detection events are comprehensively logged for audit and analysis purposes.
The system requires Python 3.13 and operates exclusively on Linux systems, with the additional requirement of elevated privileges for network monitoring and firewall management. Installation is handled through terminal commands, and once installed, the IDS is not automatically running but instead provides a menu-driven interface for configuration and control.
The user interface includes a dedicated menu system that displays all configurable parameters with their descriptions and current values. Users can modify settings by entering the field number and providing a new value of the appropriate data type. The menu also provides controls for starting and stopping the service, adding or removing the service from system autostart, and completely uninstalling the program while preserving log files.
Logging functionality stores all detected network anomalies in the file located at /var/log/network_ids/network_ids.log, allowing administrators to review security events and investigate potential threats. The repository demonstrates active development and security focus through its classification across intrusion detection, network security, and machine learning categories, indicating that the project combines traditional signature-based detection with adaptive learning mechanisms to identify both known attack patterns and anomalous behavior in network traffic.
