Skip to main content

​
System requirements

  • OS: Windows (required — Npcap is Windows-only)
  • Python: 3.8 or later
  • Privileges: Administrator rights are required to enable IPS blocking via the Windows Firewall
  • RAM: 4 GB minimum recommended (ML model + packet sniffer run concurrently)
The IPS blocking feature uses Windows Firewall rules and must be run as Administrator. Without elevated privileges the system still detects intrusions, but IP blocking will fall back to simulated mode.

​
Installation steps

1

Install Npcap

Scapy requires a low-level packet capture driver on Windows. Download and install Npcap from the official site:
https://npcap.com/#download
During installation, enable the option “Install Npcap in WinPcap API-compatible mode”.
ids.py already sets conf.use_pcap = True so Scapy will use the Npcap driver automatically once it is installed. No additional configuration is needed.
2

Clone the repository

git clone https://github.com/K-ev1004/Proyecto-IPS-IDBS-ML.git
cd Proyecto-IPS-IDBS-ML
3

Install Python dependencies

Install all required packages with pip:
pip install scapy PyQt5 matplotlib pandas numpy scikit-learn imbalanced-learn xgboost joblib requests
PackagePurpose
scapyReal-time packet capture and analysis
PyQt5GUI framework for the dashboard
matplotlibEmbedded charts in the SOC dashboard
pandasDataFrame construction for ML inference
numpyNumerical operations in the ML pipeline
scikit-learnRandom Forest, MLP, encoders, and feature selection
imbalanced-learnSMOTE oversampling used during model training (CEREBRO.py)
xgboostXGBoost classifier in the ensemble model
joblibLoading serialized .pkl model files
requestsSending Telegram alert notifications
sqlite3Built-in Python stdlib — no installation needed
sqlite3 ships with Python’s standard library and does not need to be installed separately.
4

Verify model files

The IDS requires five serialized model files to enable ML-based classification. Verify they exist in the project root:
modelo_ensamble_optimizado.pkl
features_seleccionadas.pkl
flag_encoder.pkl
protocol_encoder.pkl
tipo_ataque_encoder.pkl
You can check with:
python -c "import os; files = ['modelo_ensamble_optimizado.pkl','features_seleccionadas.pkl','flag_encoder.pkl','protocol_encoder.pkl','tipo_ataque_encoder.pkl']; [print(f, '✓' if os.path.exists(f) else '✗ MISSING') for f in files]"
If any files are missing, generate the dataset first and then train the model:
python generar_dataset.py
python CEREBRO.py
CEREBRO.py trains the ensemble (Random Forest + MLP + XGBoost), applies SMOTE balancing, and writes all .pkl files to the project root. Training typically achieves ~91.9% accuracy on the generated dataset.
Without the .pkl files, the system starts in heuristics-only mode. Attack detection still works, but events will be labeled (Heurística) instead of showing ML confidence percentages.

​
Next steps

Once installation is complete, follow the Quickstart guide to launch the dashboard and run your first detection.

Build docs developers (and LLMs) love

Get started for freeTalk to us