Overview
Human-Aware Intrusion Detection System is an AI-powered cybersecurity system that combines network intrusion detection with physical human-context awareness to provide a broader assessment of security events.
The system is designed to move beyond detecting suspicious network traffic alone. It combines machine-learning-based threat detection with physical-context information, security-event persistence, real-time monitoring, and alert delivery.
The Problem
Traditional intrusion detection systems primarily analyze network traffic. While this is useful for identifying malicious activity, network activity alone may not provide enough context to understand the severity of an incident.
This project explores a more context-aware approach by combining cybersecurity signals with physical human presence.
How It Works
The system follows an end-to-end security pipeline:
Network Traffic → Flow Construction → Feature Extraction → ML Inference → Risk/Severity Assessment → Event Persistence → Alert
A separate computer-vision component processes webcam input to detect human presence and provide physical context for security events.
The backend is exposed through a FastAPI service, while the system includes a frontend dashboard for interacting with and monitoring the application.
Machine Learning
The intrusion detection component uses XGBoost with the CICIDS2017 dataset.
The model works with network-flow features to classify different types of network activity and is evaluated using classification metrics, confusion matrices, and class-level performance analysis.
The trained model is integrated into the application so that predictions can be used as part of the live monitoring workflow rather than remaining only as an offline machine-learning experiment.
Physical Context Awareness
The physical-awareness component uses OpenCV and webcam input to detect human presence.
This information provides additional context around detected security events. For example, the system can consider whether elevated network activity is occurring alongside human activity in the monitored environment.
Real-Time Monitoring
The system includes a real-time monitoring pipeline for processing security events.
Key components include:
- Network packet and flow processing
- Feature extraction
- Machine-learning inference
- Severity assessment
- Security-event persistence
- Real-time monitoring
- Alert processing
- Failure and retry handling
Alerts
The system supports Telegram-based security alerts.
Alerts can be configured for significant security events, including detected attacks, elevated severity, and increased human presence.
This creates a complete path from detection → contextual assessment → persistent event → actionable notification.
Technology Stack
- Python
- FastAPI & Uvicorn
- XGBoost
- scikit-learn
- Scapy
- OpenCV
- NumPy & Pandas
- Joblib
- SQLite
- Plotly
- Requests
- Telegram Bot API
- Pytest
Engineering
One of the main challenges was integrating multiple systems into a single application rather than building isolated components.
The project combines machine learning, network monitoring, computer vision, backend APIs, persistence, and alert delivery into one modular security workflow.
The codebase is organized into separate areas for the API, monitoring, training, verification, alerts, utilities, and frontend components.
Results
The intrusion-detection model achieved approximately 99.9% test accuracy and a 0.91 macro-F1 on the evaluated CICIDS2017 test data.
Model behavior was evaluated using confusion matrices, classification reports, and class-level performance analysis.
What I Learned
This project helped me move beyond simply training machine-learning models and into building an end-to-end ML system.
I learned how to integrate model inference into a backend service, process security events in real time, connect computer vision with cybersecurity signals, persist events, and build an alerting workflow around model predictions.
The biggest lesson was that a useful AI system is not just about model accuracy. The surrounding engineering, monitoring, reliability, and user-facing workflow are equally important.
Log in or sign up for Devpost to join the conversation.