🚦 TCP Self-Healing Traffic Analyzer

A mini project that simulates TCP/IP network traffic, detects anomalies like SYN flooding and high-frequency packets from suspicious IPs, and performs self-healing actions such as IP blocking and mock alerting. Built to showcase system-level AI, anomaly detection, and basic cybersecurity response.

🚀 Features

• 📦 Simulates TCP packet logs using Python
• 🔍 Detects suspicious behavior using rule-based logic
• ⚠ Detects SYN-flood attempts based on TCP flag patterns
• 🛡️ Auto-blocks IPs and generates mock alerts
• 📊 Visualizes traffic per IP over time using Matplotlib
• 🧠 Logs blocked IPs for future tracking

🛠️ Tech Stack

• Python (pandas, numpy)
• Matplotlib (for traffic plots)
• Rule-based anomaly detection
• Simulated TCP/IP packet data

📁 Files

• tcp_analyzer.ipynb – Main notebook with full logic
• blocked_ips_log.csv – IPs flagged from basic anomaly logic
• final_blocked_ips_log.csv – Final list including SYN-flag patterns
• Traffic plot image (optional)

📈 Sample Output

• High-traffic IPs flagged if they send >100 packets
• IPs with >30 SYN packets also flagged
• IPs are "blocked" and an admin is alerted in simulation
• Time-based traffic chart for visual monitoring

💡 Why It Stands Out

Unlike typical Python projects, this one mimics a lightweight intrusion detection system (IDS) using AI-inspired logic, showing a deep understanding of network behavior, cybersecurity, and automated response. No web frontend or cloud needed — fully backend-engineered and AI-focused.

📌 How to Run

1. Open tcp_analyzer.ipynb in Google Colab or Jupyter
2. Run all cells step-by-step
3. Customize IP patterns, thresholds, or traffic behavior if needed
4. View alerts, blocked IP logs, and traffic charts

🔐 Disclaimer

This is a simulation project — it does not interact with real network traffic or modify firewalls. Intended for educational and showcase purposes only.