ESP32 Based Real-Time Network Intrusion Detection System
Detect WiFi attacks like Deauthentication, Beacon Flood, Probe Flood and SYN Flood in real time.
IntrusionEye is a real-time WiFi network intrusion detection system built using ESP32.
It monitors network traffic and detects suspicious activities such as Deauthentication attacks, Beacon floods, Probe floods, and SYN floods.
The project also includes a modern web dashboard that allows users to monitor alerts, network devices, packet rates, and trusted devices in real time.
IntrusionEye can detect:
- Deauthentication attacks
- Beacon flood attacks
- Probe request floods
- SYN flooding
- Suspicious network behaviour
The system uses multi-sample verification to reduce false positives.
The ESP32 hosts a live monitoring dashboard that shows:
- Attack alerts
- Severity levels
- Packet rates
- Network devices
- Trusted devices
- Scan progress
- Learning mode status
At startup the system enters learning mode where it:
- Observes normal traffic
- Builds a baseline
- Calculates automatic thresholds
- Reduces false positives
You can mark devices as trusted.
Features:
- Add trusted device via MAC address
- Quick trust devices from network scan
- Remove trusted devices
- Device labels
- Stored in ESP32 Flash (NVS)
Trusted devices persist after reboot.
| Component | Description |
|---|---|
| ESP32 Dev Board | Main controller |
| WiFi Network | Network to monitor |
| USB Cable | For programming |
Recommended boards:
- ESP32 DevKit V1
- NodeMCU-32S
- ESP32-WROOM
Install these libraries in Arduino IDE: -ArduinoJson -Preferences -WiFi -WebServer