CyTechPro — Hybrid Intrusion Detection System
Full-stack web app that wraps an ML pipeline for network intrusion detection.
- Role
- Full-stack engineer
- Context
- BS Software Engineering, final-year project
SourceFull source is private; the linked repo is a public showcase with screenshots.
Overview
My final-year project: an ensemble of ML models served through a FastAPI back end, with live packet capture, traffic-file analysis, threat alerts and a web dashboard.
Architecture
Capture
- TShark
- Traffic upload
API
- FastAPI
- Auth
Models
- Random Forest
- XGBoost
- CatBoost
- LightGBM
Client
- Dashboard
- Alerts
- Export
What it does
- Real-time packet monitoring alongside offline analysis of uploaded traffic files.
- Multi-class attack classification — DoS, DDoS, brute force and more.
- Models trained on the CICIDS2017 dataset; class imbalance handled with SMOTE.
- Dashboard with sign-in, threat-alert screen, detection results and file export.
Engineering decisions
Hybrid: offline training, online inference
Models are trained offline on a labelled dataset and served behind an API, keeping heavy training out of the request path while live traffic is scored as it arrives.
One detection API for live and uploaded traffic
Live packets captured with TShark and uploaded traffic files go through the same FastAPI detection endpoint, so the dashboard shows results, alerts and exports the same way whichever path the data came from.
ML behind a service boundary
The models sit behind a FastAPI service, so the dashboard and capture pipeline talk to a stable HTTP contract rather than to model internals.
Stack
- Python
- FastAPI
- TShark
- scikit-learn
- XGBoost
- CatBoost
- LightGBM