Works

Project: AI-Driven Mini-SOC for Real-Time Threat Detection Project

AI-Powered Intrusion Detection System (HIDS) Project

Project

AI-Powered Intrusion Detection System (HIDS)

🔍 Overview

During my cybersecurity internship at DATA SOFTWARE, a Moroccan tech company specialized in IT infrastructure and cybersecurity, I had the opportunity to design, build, and deploy a cutting-edge AI-based Host Intrusion Detection System (HIDS).

Traditional HIDS rely heavily on signature-based detection, which often fails against zero-day attacks and new anomalies. This project aimed to overcome that limitation by leveraging machine learning, specifically Deep Learning Autoencoders with GRU (Gated Recurrent Units), to detect deviations from normal system behavior in real time.

🧠 Key Objectives

Implement an AI-driven HIDS to monitor system logs and detect anomalies.
Use deep learning models (Autoencoder + GRU) to learn baseline “normal” behavior.
Enable real-time intrusion alerts for anomalous activities (e.g., port scans).
Integrate the system into a Defense-in-Depth strategy for layered protection.

🛠️ Development Process

The project followed a structured pipeline:

Log Collection & Preprocessing
System logs were collected, cleaned, and transformed into a time-series dataset.
Model Architecture
An Autoencoder with GRU units was trained to learn normal system behavior patterns.
Anomaly Detection
Any significant deviation in log sequences was flagged as a potential intrusion.
Deployment & Testing
The system was deployed on a host machine. A simulated Nmap port scan attack was used to validate detection accuracy.

🧪 Test Scenario: Nmap Port Scan Detection

Phase 1: System ran under normal conditions — no alerts.
Phase 2: An attacker initiated a port scan using Nmap.
Phase 3: The AI-HIDS detected abnormal behavior and triggered an alert in real time.