NetSentry-AI

# NetSentry-AI 🛡️

NetSentry-AI is an open-source, AI-driven network monitoring and packet analysis tool. It processes packet capture (`.pcap`) files, extracts crucial network features, and utilizes Unsupervised Machine Learning (Isolation Forest) to detect anomalies, suspicious communications, and potential network attacks such as Port Scans and DDoS attempts.

---

## ✨ Features

* **PCAP Parsing:** Efficiently reads packet captures using `scapy` without overloading system memory.
* **Feature Extraction:** Extracts Source/Destination IPs, Ports, TTL, TCP Flags, and Packet Lengths.
* **AI Anomaly Detection:** Utilizes `scikit-learn`'s Isolation Forest algorithm to detect deviations from normal network behavior without requiring labeled training data.
* **Attack Identification:** Automatically flags potential port scanners and flooding sources.
* **CSV Reporting:** Exports detected anomalies to a structured CSV file for further forensic analysis.

---

## Screenshots

### 1. Terminal Execution & Anomaly Detection
Below is the CLI output when running NetSentry-AI on a network capture, showing feature extraction and detected anomalous packets:

![Terminal Execution](screenshots/test_1.png)

### 2. Exported Anomaly Report
The detailed forensic report generated in `results/anomalies.csv` containing network parameters, flags, and ML anomaly scores (`-1` indicates flagged anomaly):

![CSV Report Output](screenshots/test_1_result.png)

---

## ⚙️ Prerequisites (Windows)

* Python 3.13 or 3.14
* [Npcap](https://npcap.com/) (Required for Scapy to capture/read network packets on Windows)

---

## 🚀 Installation

1. **Clone the repository:**
```bash
git clone https://github.com/JuttSahib1999/NetSentry-AI.git
cd NetSentry-AI

```


2. **Install the required Python dependencies:**
```bash
pip install -r requirements.txt

```



---

## 💻 Usage

Place your `.pcap` files inside the `data/` folder (or reference them directly). Run the main script via the command line:

```bash
python app/main.py data/sample.pcap --output results/detected_anomalies.csv --contamination 0.01

```

* `--output`: (Optional) Path to save the resulting anomalies. Defaults to `results/anomalies.csv`.
* `--contamination`: (Optional) The expected proportion of anomalies in the dataset. Defaults to `0.01` (1%). Increase this if the tool is missing attacks, or decrease it if there are too many false positives.

---

## 👨‍💻 Author

Created by **Abdul Muqeet Tabraiz**

* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)

---

## 📄 License

This project is licensed under the MIT License - see the `LICENSE` file for details.