HackGuard: Protector of Networks

Analysis
outlier dection
Interface sliding windows
Who we are
Example of 2 features

Inspiration

We've just started a cybersecurity course, and while dealing with data theft cases, we've realized how easy it is for attacks to go unnoticed. Hence, it's been a project from scratch to learn to create something akin to an IDS/firewall.

What it does

We've developed a model that learns what constitutes an attack on a user/network, enabling us to efficiently detect intrusions. Our dataset comprises both categorical and numerical variables, requiring algorithms to calculate meaningful parameterizations among them. As it's sometimes challenging to link these aspects, we've employed unsupervised learning to train the model, avoiding labeling issues with certain values. The essence of this endeavor lies in conducting real-time analysis that updates continuously. To achieve this, we capture incoming packets in 3-second windows, sliding them over time to observe network evolution. Sometimes envisioning this is a bit complicated because it's something we can't physically see. Therefore, we've developed a graphical interface that displays each window and the packets captured within it. For each packet, we can observe its protocol, port, among other variables. This interface updates every 3 seconds, enabling us to simulate attacks. If suddenly there's an influx of connections within a single window, and the model flags them as malicious, we can determine the type of attack and alert the team to take action promptly.

How we built it

We've relied on using Python along with several libraries including Scapy as a hacking tool, Streamlit for visualization, Tkinter for the graphical interface, among many others. We had to learn to use all three because we were unfamiliar with their existence. We believed the essence lay in handling all aspects of data ourselves and training them to increase the difficulty, as many people tend to use pre-existing solutions, but we wanted to build everything from scratch.

Challenges we ran into

Upon reviewing the challenges, I believe none of them fit our working style, so we dedicated ourselves to designing the one I've explained. We had a hard time trying to find a suitable unsupervised learning algorithm able to train our model. Also, as we are doing real-time processing, we had some challenges on how to process the date and get the different behaviours of the packets over time.

Accomplishments that we're proud of

Things we take home:

Training complex models with unsupervised methods that we did not know before
Creating interactive graphs
Learning libraries
Exploring many new areas of cybersecurity
Making a more visual and user-friendly output rather than a backend print, as we are all studying data science and we have almost no knowledge on front-end.

What we learned

We have mastered the uses of network layers and data movement, data capture, analyzing this data with different tools, using new libraries, new modes of graphical interfaces. We have improved our ability to optimize time, enhanced team building, improved communication. Wow, with just 36 hours, so many things!

What's next for HackGuard: Protector of Networks

Certainly, there are plenty of improvements to consider, such as increasing the number of detections across different layers, detecting more attacks. Who knows, maybe we can develop this idea into some larger project. Very proud to have participated and eager to learn more. We want to express our gratitude for the opportunity. We hope you like the project!!!