NetGuard: Dual-Branch Network Intrusion Detection System (NIDS)

NetGuard is a deep learning–based Network Intrusion Detection System (NIDS) that identifies and classifies 15 categories of network traffic, ranging from benign flows to sophisticated attacks such as DDoS, Botnet activity, and Infiltration attempts.

Trained on the 2.3-million-row CIC-IDS2017 dataset, NetGuard uses a dual-branch neural network that analyzes statistical flow features and raw payload bytes in parallel, fusing the two through an attention mechanism to deliver state-of-the-art threat detection.

---

System Architecture

NetGuard processes network traffic through two complementary modalities — learning both the temporal statistical behavior of a connection and the spatial patterns embedded in packet payloads.

graph TD
    classDef branch fill:#2c3e50,stroke:#34495e,stroke-width:2px,color:#fff;
    classDef fusion fill:#8e44ad,stroke:#9b59b6,stroke-width:2px,color:#fff;
    classDef output fill:#27ae60,stroke:#2ecc71,stroke-width:2px,color:#fff;
    classDef input fill:#2980b9,stroke:#3498db,stroke-width:2px,color:#fff;

    A[Raw Network Traffic]:::input --> B(Statistical Flow Features <br/> 77 Dimensions):::input
    A --> C(Raw Payload Bytes <br/> 256-Byte Sequence):::input

    B -->|StandardScaler| D[BiLSTM Branch <br/> Temporal Extraction]:::branch
    C -->|Normalized| E[1D-CNN Branch <br/> Spatial Extraction]:::branch

    D --> F{Attention-Gated Fusion}:::fusion
    E --> F

    F --> G[Fully Connected Layers <br/> 512 → 256]:::branch
    G --> H([15-Class Threat Prediction]):::output

Loading

---

Architectural Decisions & Optimization

Building a model robust enough to handle the CIC-IDS2017 dataset meant overcoming severe class imbalance and representation collapse. Here are the key design decisions behind the production-ready model.

1. Dual-Branch Modality

The problem: Different attacks leave different signatures. A brute-force attack is obvious in temporal flow data (packet frequency), while a SQL injection is hidden entirely in the payload string.

The solution: A BiLSTM processes the 77-dimensional flow data to capture sequential statistical anomalies, while a 1D-CNN scans the raw 256-byte payload sequence to detect malicious spatial patterns.

2. Attention-Gated Fusion

The problem: Simple feature concatenation forces the network to weigh flow and payload data equally, even when one modality is uninformative for a given attack type.

The solution: An attention-gated fusion mechanism, built on sigmoid gates, lets the network dynamically suppress the payload branch during a volumetric DDoS attack, or suppress the flow branch during a stealthy XSS payload attack.

3. Dampened Focal Loss & Representation Collapse

The problem: The dataset is highly imbalanced — over 80% benign traffic versus rare attack classes with fewer than 20 samples. Standard inverse-frequency class weighting caused the model to hyper-fixate on rare attacks, collapsing benign-class performance to a 0.00 F1-score (representation collapse).

The solution: A mathematically dampened weight distribution, using a square-root penalty capped at a maximum multiplier of 10.0, combined with Focal Loss (γ = 2.0). This lets the model aggressively target hard-to-classify rare attacks without inflating false positives on standard traffic.

4. Curriculum Learning Pipeline

Rather than exposing the untrained network to all 15 classes at once, the dataloader follows a curriculum schedule: easy, highly distinguishable classes in epochs 1–2, medium-difficulty threats in epochs 3–4, and the full dataset for the remaining training duration.

---

Results & Evaluation

By resolving gradient flow issues with StandardScaler and correcting extreme class weighting, NetGuard achieved strong convergence over a 15-epoch training cycle.

Metric	Value
Validation Accuracy	99.25%
Benign F1-Score	0.996
DDoS F1-Score	0.997
Loss Convergence	~0.10

Deep Dive: The Model in Action

Status	True Threat	Predicted Threat	Confidence
Correct	Benign	Benign	64.74%
Correct	DoS Hulk	DoS Hulk	81.24%
Correct	DDoS	DDoS	82.15%
Confused	Benign	DoS Slowhttptest	89.85%
Missed	DoS Hulk	Benign	52.04%
Missed	SSH-Patator	Benign	62.25%

---

Installation & Setup

Prerequisites

• Python 3.10+
• NVIDIA GPU (CUDA Toolkit) recommended for training

1. Clone the Repository

git clone https://github.com/Asmit159/Net-Guard.git
cd Net-Guard

2. Install Dependencies

pip install torch torchvision torchaudio numpy pandas scikit-learn pyyaml tqdm matplotlib seaborn

3. Prepare the Data

Place your CIC-IDS2017 parquet files in the directory specified by configs/train.yaml. The system automatically handles payload generation and feature normalization.

---

Usage

Training the Model

To start the 15-epoch training run with curriculum learning and automated learning-rate decay (ReduceLROnPlateau):

python train.py --config configs/train.yaml

This outputs netguard_best.pth (model weights) and netguard_scaler.pkl (the fitted StandardScaler) to the /checkpoints directory.

Running Inference

To use NetGuard for live packet evaluation, load the saved model and scaler:

import torch
import joblib
from model import NetGuard

# 1. Load the fitted scaler
scaler = joblib.load('checkpoints/netguard_scaler.pkl')

# 2. Initialize and load the model
device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
model = NetGuard(num_classes=15).to(device)
model.load_state_dict(torch.load('checkpoints/netguard_best.pth')['model_state_dict'])
model.eval()

# 3. Pass live packet data through the pipeline
# scaled_flow = scaler.transform(raw_flow)
# prediction = model(payload_tensor, flow_tensor)

---

License & Contact

Developed by Asmit Mandal. Licensed under AGPL v3.