ml_ids is a real-time hybrid intrusion detection system. Rule-based signatures catch known attacks. A custom-trained XGBoost model flags the ones nobody has named yet.

What you get

• Full Python source (Flask app + detection engine)
• Pre-trained XGBoost model + 264 signature rules across 15 attack categories
• 39-feature traffic pipeline, LIME explanations, sub-30ms detection
• 8-page dashboard with WebSocket alerts and JSON/CSV/PDF reports
• Install guide, API docs, sample UNSW-NB15 and CICIDS2017 snippets

Who it’s for
Cybersecurity students, researchers, and homelab users who want a transparent, self-hosted IDS — not a black-box enterprise box.

Run it locally. See why every prediction fired. Extend the codebase.