Rule-Based Network Intrusion Detection System (NIDS)

About the Project

The Rule-Based NIDS is a high-performance network intrusion detection system designed to strengthen enterprise security posture. It detects and prevents known attacks using a predefined set of rules and signatures, ensuring fast and reliable threat identification.

This system integrates with a MySQL database that efficiently organizes large-scale packet datasets, alerts, and incident reports. Real-time analysis of traffic across all layers of the network — from packet metadata to transport details — ensures rapid detection with low false positives.

The project also provides automated logging, alerting, and reporting, making it scalable and adaptable for integration into enterprise security infrastructures.

---

Features

• Rule-based detection of known network threats (DDoS, brute force, insider threats, etc.)
• MySQL-backed storage for packets, alerts, incidents, and users
• User management (create, update, delete, change roles)
• Alert generation for suspicious activity
• Triggers and stored procedures for automatic detection of anomalies
• Logging and reporting for audits and investigations
• Swing-based UI for management and monitoring
• Extensible architecture for future anomaly-based or AI-powered detection

---

Tech Stack

• Programming Language: Java (Swing for UI)

• Database: MySQL

• Backend Services: Stored Procedures, Functions, Triggers

• Authentication: Password hashing, JWT, OAuth2, API tokens

• Security Features:

  • Login rate limiting
  • Secure credential storage
  • Session/token expiration

• Other Utilities: JSON parsing, regex filtering, log formatting, IP range checks

---

Project Structure

Rule-Based-NIDS/
│
├── src/main/resources/
│   ├── schema.sql                # Database schema
│   ├── ui/                       # UI (HTML, CSS, JS, Swing)
│
├── src/main/java/com/network/security/
│   ├── auth/                     # Authentication logic (login, tokens, hashing)
│   ├── controller/               # REST APIs or UI event handlers
│   ├── dao/                      # DAO layer (MySQL interaction for packets, alerts, users, rules)
│   ├── entity/                   # POJOs mapping to MySQL tables
│   ├── services/                 # Intrusion detection, classification, alerts, threshold mgmt
│   ├── util/                     # Helper functions (JSON parsing, regex, IP range checks)
│
└── README.md

---

Database Design

Key Tables

• Users → Stores user credentials, roles, and access levels
• Packet Data Tables → Holds metadata for captured packets
• Alerts → Stores alerts generated by detection mechanisms
• Rules Tables → Holds predefined rules (DDoS thresholds, brute force attempts, insider threats, etc.)
• Blacklist Tables → Stores blacklisted domains and ports

Example Functions & Procedures

• Functions

  • validate_packet_length(packet_size) → Detects anomalies in packet size
  • validate_packet(packet_data) → Detects malformed packets

• Stored Procedures

  • sp_add_user() / sp_update_user() / sp_delete_user() / sp_change_user_role()
  • check_ddos_attack() → Detects DDoS by comparing packet count against threshold
  • detect_brute_force_attack() → Detects repeated failed logins
  • detect_insider_threat() → Detects excessive or suspicious access patterns

• Triggers

  • block_blacklisted_ports → Prevents packets on blacklisted ports
  • block_blacklisted_domains → Flags access to malicious domains
  • detect_suspicious_user_agents → Detects malicious user agents

---

Intrusion Detection Capabilities

• Denial of Service (DoS/DDoS) detection
• Brute force attack detection
• Deep Packet Inspection (DPI) for suspicious headers
• Port scanning activity monitoring
• Insider threat detection (e.g., abnormal file access)
• Packet sniffing & parsing for real-time monitoring

---

Network Protocol Coverage

The system analyzes packets across all OSI layers:

• Data Link Layer: Ethernet, Wi-Fi headers
• Network Layer: IPv4, IPv6 headers
• Transport Layer: TCP, UDP headers
• Application Layer: HTTP/HTTPS, DNS, TLS/SSL headers

---

Getting Started

Prerequisites

• Java 11+
• MySQL 8.0+
• Maven/Gradle for dependency management

Setup Instructions

1. Clone the repository:

   git clone https://github.com/your-username/Rule-Based-NIDS.git

2. Create the database using the schema file:

   source src/main/resources/schema.sql;

3. Configure database credentials in application.properties (or config file).

4. Build and run the project:

   mvn clean install
   java -jar target/rule-based-nids.jar

5. Launch the Swing UI or access via REST APIs for monitoring.