The Problem with Traditional IDS

Modern enterprise networks face increasingly sophisticated threats that evade signature-based detection. Identifying anomalous behavioral patterns in real-time without massive computational overhead remains a significant challenge for security teams. During my research into network security, I noticed that most open-source solutions lacked a streamlined, analyst-focused dashboard that could integrate machine learning directly into the alerting pipeline.

The Solution: AnomalyX

AnomalyX is a SOC-style Network Intrusion Detection Dashboard. It uses a Random Forest–based detection engine trained on the NSL-KDD dataset to classify network traffic (DoS, Probe, R2L, U2R), map threats to MITRE ATT&CK techniques, and provide analyst-focused interactive dashboards for incident analysis.

Key Features

• Random Forest Engine: Categorizes attacks into DoS, Probe, R2L, and U2R with high accuracy.
• MITRE ATT&CK Mapping: Alerts are severity-based and mapped to the standard framework for faster analyst triage.
• Interactive Dashboards: Visualizes confusion matrices, alert volumes, and threat types.

The Tech Stack

• Backend: Python, Flask
• Machine Learning: Scikit-learn, Random Forest, Pandas
• Dataset: NSL-KDD

Learnings & Takeaways

Building AnomalyX taught me how to effectively integrate Machine Learning within a SOC context. I gained immense practical experience in cleaning and classifying large datasets and building intuitive dashboards that help analysts quickly interpret false positives and negatives.

Check out the repository on GitHub to see the source code!