This project implements and compares reinforcement learning algorithms (DQN and A3C) for network intrusion detection using the NSL-KDD dataset. The project is organized into three main components for better maintainability and deployment:
IDS_Training/ # RL Model Training & Research
├── data/ # Training datasets (NSL-KDD)
├── models/ # Trained models specific to training
├── utils/ # Training utilities
├── IDS_RL_Gymnasium.py # Custom Gymnasium environment
├── IDS_DQN_Environment.ipynb # DQN training notebook
├── IDS_A3C_Environment.ipynb # A3C training notebook
└── README.md # Training documentation
IDS_API/ # REST API Service
├── ids_api.py # Flask API server
├── train_scaler.py # Scaler training utility
├── sample_*.json # API testing samples
└── README_IDS_API.md # API documentation
IDS_Live/ # Real-time GUI Application
├── final_ids_gui.py # Main GUI application
├── launch_ids.py # Dependency checker & launcher
├── live_ids_predictor_fixed.py # Packet capture utilities
├── aggressive_attack_simulator.py # Attack simulation
└── README_Enhanced_IDS.md # GUI documentation
shared/ # Shared Resources
├── models/ # Trained models & scalers
├── utils/ # Common utilities
├── data/ # Shared datasets
└── README.md # Shared components info
cd IDS_Training
# DQN training
jupyter notebook IDS_DQN_Environment.ipynb
# A3C training
jupyter notebook IDS_A3C_Environment.ipynbcd IDS_API
python ids_api.py# From project root
python IDS_Live/launch_ids.py
# or use batch file
Start_IDS_Launcher.bat# Install dependencies
pip install stable-baselines3 gymnasium scikit-learn pandas numpy torch flask scapy
# Verify installation
python IDS_Live/launch_ids.py- Purpose: Model training, experimentation, research
- Key Files: Gymnasium environment, training notebook
- Output: Trained DQN models, scalers, evaluation metrics
- Purpose: REST API for IDS predictions
- Key Features: HTTP endpoints, JSON input/output, scalable service
- Usage: Integrate IDS into other applications
- Purpose: Real-time network monitoring with GUI
- Key Features: Packet capture, live detection, visual alerts
- Target: End-user security monitoring
- Purpose: Common models, utilities, data used across components
- Benefits: Avoid duplication, centralized model management
- Contents: Trained models, feature engineering utilities, datasets
This architecture supports the Master's thesis research on:
- Reinforcement Learning Algorithms: DQN and A3C comparison for cybersecurity (IDS_Training)
- Real-world deployment of RL models (IDS_API)
- Practical security applications (IDS_Live)
Each component can be developed, tested, and deployed independently while sharing common resources.