SwarmID-Intrusion-Detection-System - SwarmID - Anomaly-Based Intrusion Detection System

项目说明

SwarmID - Anomaly-Based Intrusion Detection System Using Swarm Intelligence

![.NET]()
![C#]()
![Blazor]()
![LiteDB]()
![SignalR]()

A comprehensi detection system that le swarm intelligence algorithms (Ant Colony Optimization and Bee Algorithm) to detect network anomalies in real-time. The system provides ad network traffic analysis, anomaly classification, and an intuiti dashboard for security monitoring.

🚀 Features

🧠 Swarm Intelligence Algorithms

Ant Colony Optimization (ACO): Mimics ant foraging behavior for pattern recognition

Bee Algorithm: Uses bee colony optimization for efficient anomaly detection

Hybrid Detection: Combines both algorithms for enhanced accuracy

📊 Real-time Monitoring

Li traffic analysis and

Instant anomaly alerts

Interacti with filtering and search capabilities

Real-time performance metrics and statistics

🔍 Multi-format Traffic Analysis

Zeek Logs: Parse and analyze Zeek network security monitor logs

Snort Alerts: Integration with Snort intrusion detection alerts

PCAP Files: Direct packet capture file analysis

Real-time Traffic: Li traffic simulation and monitoring

🎯 Anomaly Classification

Port Scan Detection: Identify reconnaissance acti

DDoS Attack Detection: Detect distributed denial-of-service patterns

Command & Control (C&C): Identify botnet communication

Data Exfiltration: Detect unauthorized data transfers

📈 Performance Metrics

Detection Accuracy: 89-92% across both algorithms

Processing Speed: 120-150ms per traffic record

Memory Efficiency: 38-45MB resource usage

Low False Positives: 3-5% false positive rate

🏗️ Architecture

The system follows a clean architecture pattern with clear separation of concerns:

📁 Project Structure

🚀 Quick Start

Prerequisites

.NET 8.0 SDK

Studio 2022 or VS Code

Windows 10/11 or Linux

Installation

1. Clone the repository

2. Restore dependencies

3. Build the solution

4. Run tests

Running the Application

#### Option 1: Using Studio
1. Open SwarmID.sln in Studio 2022
2. Set multiple startup projects:
- SwarmID.Api
- SwarmID.Dashboard
3. Press F5 to start debugging

#### Option 2: Using Command Line

Start the API (Terminal 1):

Start the Dashboard (Terminal 2):

Access the Application

Dashboard:

API:

API Documentation:

📸 Screenshots

Main Dashboard

!Main Dashboard
*Real-time system o with anomaly detection statistics and performance metrics*

Traffic Analysis Page

!Traffic Analysis
*Network traffic monitoring with file upload and real-time analysis capabilities*

Anomaly Management

!Anomaly Management
*Comprehensi review and management interface*

API Documentation (Swagger)

!API Documentation
*Interactive API documentation with endpoint testing capabilities*

Real-time Monitoring

!Real-time Monitoring
*Li traffic and instant anomaly alerts*

PCAP File Upload

!PCAP Upload
*File upload interface for PCAP, Zeek logs, and Snort alerts analysis*

📊 Usage

1. Dashboard O

Na to the main dashboard to see real-time system status

Monitor acti and system performance metrics

View algorithm performance comparisons

2. Traffic Monitoring

Go to the Traffic page for li traffic analysis

Upload PCAP files or Zeek logs for analysis

Monitor real-time traffic patterns and statistics

3. Anomaly Management

Access the Anomalies page to review detected threats

Update anomaly status and add analyst feedback

Filter and search through historical anomalies

4. API Integration

Use the REST API for programmatic access

Integrate with existing security tools and SIEM systems

Access Swagger documentation for API details

🧪 Testing

The project includes comprehensive test co:

Test Co:

✅ Unit tests for swarm algorithms

✅ Integration tests for API controllers

✅ Repository layer tests

✅ Traffic analysis tests

✅ End-to-end workflow tests

🔧 Configuration

Algorithm Parameters

Configure swarm intelligence algorithms in appsettings.json:

Database Configuration

LiteDB configuration for data storage:

📈 Performance Optimization

Algorithm Tuning

Adjust ant colony parameters for different network en

Optimize bee algorithm parameters based on traffic patterns

Fine-tune detection thresholds for specific use cases

Scalability

Horizontal scaling support through load balancing

Asynchronous processing for high- traffic

Configurable worker threads for parallel analysis

🔒 Security Considerations

Input for all network traffic data

Secure API endpoints with proper authentication

Sanitized database queries to prevent injection attacks

Encrypted storage for sensiti data

📚 Documentation

System Architecture: Detailed architectural o

API Documentation: HTTP requests and responses

Diagram Documentation: Mermaid diagrams usage guide

Screenshot Guide: Instructions for adding documentation

Screenshot Checklist: Quick reference for required screenshots

📸 Adding Screenshots

To add screenshots to this documentation:

1. Prerequisites: Ensure both services are running

2. Take Screenshots: Visit the URLs and capture screenshots
- Dashboard:
- API Docs:

3. Sa: Place PNG files in docs/images/ with exact names:
- dashboard-main.png
- traffic-analysis.png
- anomaly-management.png
- api-swagger.png
- realtime-monitoring.png
- pcap-upload.png

4. Automatic Display: Images will appear automatically in the README

See docs/SCREENSHOT_GUIDE.md for detailed instructions.

🤝 Contributing

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

De Guidelines

Follow SOLID principles and clean architecture patterns

Write comprehensive unit tests for new features

Use async/await patterns for I/O operations

Implement proper error handling and logging

Follow C# coding con and best practices

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

👥 Authors

Adnane Arharbi - *Initial work* - YourGitHub

🙏 Acknowledgments

Inspired by swarm intelligence research in cybersecurity

Built with modern .NET technologies and best practices

Special thanks to the open-source community for tools and libraries

---

SwarmID - Protecting networks through the power of swarm intelligence 🐝🐜

项目信息

开发语言：C#

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕SwarmID - Anomaly-Based Intrusion Detection System Using Swarm Intelligence展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。