Engineering a Real-Time ML Network IDS Dashboard

2026-07-18 · Source: Machine Learning on Medium · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, medium

Summary

The Sentinel project introduces a lightweight, real-time network intrusion detection dashboard powered by a Random Forest model trained on the NSL-KDD dataset. Unlike typical ML IDS projects that stop at model training, Sentinel captures live network traffic, reconstructs the necessary feature space, and displays attack verdicts in a Flask dashboard as packets arrive. The system uses a Kali Linux VM as an attacker and a Windows host as a target within an isolated VirtualBox network. The Random Forest model, chosen for its tolerance to mixed inputs and lack of feature scaling needs, achieves 99.68% accuracy, 1.00 precision, 0.99 recall, and 1.00 F1 score on a 30% validation split. A key engineering challenge addressed is transforming live packets into connection-level features, which Sentinel handles using a rolling connection window and honest approximation of missing NSL-KDD fields. Validation with Kali's hping3 SYN flood confirmed the live pipeline's ability to detect attack patterns.

Key takeaway

For MLOps Engineers building real-time security systems, you must prioritize robust feature engineering and artifact alignment over raw model accuracy. Your live pipeline's ability to transform messy packet data into the exact feature structure expected by the model is critical. Ensure you save fitted encoders and feature column order alongside your trained model to prevent train-serve mismatch. This approach ensures your system remains observable and reliable against actual network traffic, even with necessary feature approximations.

Key insights

Bridging the gap between trained ML models and real-time network traffic requires meticulous feature engineering and honest pipeline design.

Principles

• Live data must match training feature structure.
• Telemetry quality directly impacts model performance.
• Model artifacts (encoders, columns) require alignment.

Method

Sentinel captures live packets, derives connection features using a rolling window, encodes categorical values, builds model input, predicts, and sends verdicts to a Flask dashboard.

In practice

• Use Random Forest for mixed data, no scaling.
• Save model, encoders, feature order via joblib.
• Validate with real attack traffic like hping3.

Topics

• Network IDS
• Real-time ML
• Feature Engineering
• Random Forest
• MLOps
• Scapy

Code references

• sarthakdewanda/ml-network-ids-dashboard

Best for: Machine Learning Engineer, AI Engineer, MLOps Engineer

Related on AIssential

• How I Built a Scalable Feature Pipeline for Machine Learning — Reliable feature delivery, not feature engineering, is the core challenge in production ML systems.
• Getting a transit-fraud detector into production by fixing the features, not the model — Effective fraud detection prioritizes feature engineering over model complexity, especially for evolving adversarial patterns.
• From Failure to Alignment: A Requirements Engineering Framework for Machine Learning Systems — REAL systematically integrates failure analysis into requirements engineering for ML systems, ensuring alignment with stakeholder needs.
• Expected Goals, End-to-End: An MLOps Pipeline for Hockey on Databricks — Production-ready MLOps infrastructure, not model complexity, ensures reliable and governed machine learning deployments.
• The Data Pipeline Is More Important Than the AI Model — Reliable data pipelines and robust infrastructure are more critical for successful AI trading systems than sophisticated machine learning models.
• Real-time features, AI search, Agentic similarities — Kronon uniquely solves real-time feature computation challenges for AI/ML by integrating streaming, online serving, and offline training.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Machine Learning on Medium.