Real-time network intrusion detection on a Raspberry Pi 5. Combines a Random Forest classifier trained on CIC-IDS-2017 with AbuseIPDB threat intelligence to detect attacks across 13 attack vectors - passively, with zero network impact.
Every packet on the network passes through a four-stage pipeline running on the Pi 5.
Source and destination IPs are checked against the AbuseIPDB community database. Any IP scoring above 50/100 triggers an immediate SMS alert - no ML classification needed.
If no threat intel hit, the flow vector is passed to the Random Forest classifier. A custom 50% confidence threshold filters uncertain predictions before alerting.
Trained on CIC-IDS-2017, 80/20 stratified split - 743,216 training / 185,805 test samples.
| Class | F1 Score | Live Detected |
|---|---|---|
| BENIGN | ✓ | |
| DDoS | ✓ | |
| DoS GoldenEye | ✓ | |
| DoS Hulk | ✓ | |
| DoS Slowhttptest | ✓ | |
| DoS Slowloris | ✓ | |
| FTP-Patator | ✓ | |
| PortScan | ✓ | |
| SSH-Patator | ✓ | |
| Other Attack | ✗ | |
| Bot | ✗ | |
| Web Attack — Brute Force | ✗ | |
| Web Attack — XSS | ✗ | |
| Macro Average | — |
Built entirely on open source tools, deployable on affordable hardware.