How to use Python to build a basic intrusion detection system?

In creating an intrusion detection system, we will use the concept of Network Security Monitoring (NSM) for identifying unusual activity. This will be done by examining packets in network traffic leading into and out of an organization's systems, checking for unusual or suspect content. We will use the ‘scapy’ library of Python for our task.

Step 1. Installing the necessary tools

# to install scapy library
pip install scapy

Step 2. Importing necessary libraries

# importing necessary libraries
from scapy.all import *
import sys

Step 3. Defining the program parameters

We need to define the number of arguments required for our program, which are the interface and the number of packets.

# defining number of arguments
if len(sys.argv) !=3:
   print "Usage: python "+sys.argv[0]+" < interface > < no. of packets >"
   sys.exit(1)

Step 4. Defining the Packet Callback function

This is a function that will process each packet detected by scapy's sniff function. This function will be different for every program depending on what the person wants to do with the packet.

def PacketCallback(Packet):
    if Packet[TCP].payload:
       mail_packet=str(Packet[TCP].payload)
       if 'user' in mail_packet.lower() or 'pass' in mail_packet.lower():
          print "[*] Server: %s" % Packet[IP].dst
          print "[*] %s" % Packet[TCP].payload

Step 5. Packet sniffing

Here, we define the sniffing function. It receives the interface to sniff on and the number of packets to sniff for as arguments from the command line. Also, the prn option tells scapy which function to apply to each packet that is sniffed.

# Packet sniffing
sniff(filter="tcp port 110 or tcp port 25 or tcp port 143",iface=sys.argv[1],prn=PacketCallback,count=int(sys.argv[2]))

That’s all, run your Python code and check for any unusual activity by unauthorized intruders in your network. This is a very basic illustration of how one can use Python to build an intrusion detection system.

Please note, this intrusion detection system is very basic and might not detect advanced breaches or intrusions. For serious security applications, it is advised to use mature and tested software along with rigorous security practices.

Disclaimer: This method should only be used to protect your own network or network you have permission to analyze. Unauthorized network scanning is illegal in many jurisdictions.