AI-Driven Intrusion Prevention System (IPS)

An advanced, real-time Intrusion Prevention System designed to monitor, detect, and mitigate anomalous system behaviors. This project leverages Extended Berkeley Packet Filter (eBPF) for low-overhead system call tracing, Long Short-Term Memory (LSTM) Neural Networks for sequential anomaly detection, and Docker for dynamic process isolation.

---

Overview

Traditional signature-based security mechanisms are frequently bypassed by zero-day vulnerabilities and polymorphic malware. This project proposes a behavioral-based security architecture. By continuously monitoring the sequence of system calls executed by running processes at the kernel level using eBPF, the system generates high-fidelity telemetry data.

This data is streamed to a pre-trained LSTM neural network capable of discerning complex patterns of normal execution and identifying malicious deviations. Upon detecting an anomalous sequence, the automated mitigation pipeline executes, dynamically migrating or isolating the compromised process into a secure Docker sandbox environment to contain the threat and prevent systemic compromise.

---

Key Capabilities

Feature	Description
Low-Overhead Kernel Telemetry	Utilizes eBPF to conduct highly efficient, real-time system call tracing without the performance penalties of traditional user-space monitoring.
Sequential Anomaly Detection	Employs an LSTM neural network designed to analyze time-series system call data, enabling the detection of sophisticated, multi-stage attacks based on behavioral divergence.
Automated Threat Mitigation	Integrates an automated response pipeline that reacts instantaneously to identified threats by executing predefined containment protocols.
Dynamic Sandboxing	Leverages Docker containerization to securely quarantine malicious processes, allowing for safe observation and forensic analysis without risking the host environment.
Configurable Architecture	Provides a central configuration interface to adjust detection thresholds, monitoring paths, and mitigation strategies.

---

Project Architecture

The system is modularized into the following core components:

.
├── pipeline.py                    # Central orchestration module — manages data flow from observation to mitigation
├── ebpt.py                        # eBPF kernel probes for capturing and filtering system call telemetry
├── observation_system.py          # Processes and structures raw eBPF telemetry for neural network ingestion
├── lstm_trainier.py               # LSTM training module using labeled benign/malicious syscall datasets
├── syscall_lstm_model.weights.h5  # Compiled weights of the trained LSTM model
├── container_manager.py           # Docker daemon interface for sandbox environment lifecycle management
├── process_migration.py           # Logic for suspending, migrating, and resuming compromised processes
├── Dockerfile.sandbox             # Defines the secure, restricted sandbox containment environment
├── malicious.py                   # Controlled simulation script for validating IPS detection capabilities
└── config.yaml                    # Central configuration file for system parameters and operational modes

---

Prerequisites

Deployment requires an environment configured for kernel-level tracing and containerization.

• Operating System: Linux (Ubuntu/Debian recommended) — Kernel version 4.15 or higher
• Containerization: Docker Engine installed and running
• Runtime: Python 3.8 or higher
• System Dependencies: BCC (BPF Compiler Collection) — strictly required for compiling and injecting eBPF programs into the kernel

---

Installation and Setup

1. Install System Dependencies

# Update package list
sudo apt-get update

# Install BCC tools and matching kernel headers
sudo apt-get install -y bpfcc-tools linux-headers-$(uname -r)

# Ensure Docker is installed and running
sudo apt-get install -y docker.io
sudo systemctl enable --now docker

2. Install Python Dependencies

# Create and activate a virtual environment
python3 -m venv venv
source venv/bin/activate

# Install machine learning, container management, and eBPF integration libraries
pip install tensorflow keras docker pyyaml bcc

3. Provision the Sandbox Environment

docker build -t sandbox-env -f Dockerfile.sandbox .

---

Usage

1. Initialize the IPS Pipeline

The main pipeline must be executed with elevated privileges (root) to allow eBPF to attach probes to the Linux kernel:

sudo python3 pipeline.py

2. Validate Detection Capabilities

In a separate terminal session, execute the provided simulation script to trigger the anomaly detection and mitigation workflow:

python3 malicious.py

3. Model Retraining

To adapt the system to new environments or integrate novel threat profiles, execute the training module with updated datasets:

python3 lstm_trainier.py

---

Disclaimer

This software is developed for academic research, educational purposes, and defensive security engineering. Ensure explicit, documented authorization is obtained prior to deploying kernel-level monitoring tools on any production infrastructure or network.