netSecDSS

Decision Support System for Risk Assessing Network and System Security in SMEs

A Docker-based network security monitoring platform built for small and medium enterprises that can't afford commercial SIEM tools. It simulates a realistic multi-subnet SME network, runs staged attack scenarios against it, detects and classifies threats in real time using a Python pipeline mapped to MITRE ATT&CK, scores risk quantitatively, and surfaces results through Grafana dashboards and a plain-language management report.

Originally developed as a graduation project at Palestine Technical University (Kadoorie).

What it does

• Simulates an SME network — HR, Finance, Sales, and IT subnets plus a DMZ web server — using Docker
• Generates realistic background traffic and 11 staged attack scenarios (brute force, SQL injection, lateral movement, ransomware, and more) mapped to a 4-stage Cyber Kill Chain
• Parses auth, web, firewall, and packet-capture logs in real time and classifies threats against MITRE ATT&CK
• Scores risk per-IP and network-wide using a weighted model with analyst-gated decay
• Visualises live threat data, trends, and financial exposure in Grafana
• Generates a management-facing incident report translating technical alerts into business impact and recommended action

See docs/architecture.md for the full system design, topology, and diagrams.

Tech stack

Docker & Docker Compose · Python 3 · Bash · InfluxDB v3 · Grafana · Flask · Nginx · Portainer

Project structure

docker/         Dockerfiles and docker-compose.yml
detection/      Log parsing, PCAP parsing, threat detection, risk scoring
attacks/        11 staged attack scripts
noise/          Per-department background traffic generators
monitoring/     Flask report server, docker health monitor, Grafana dashboard exports
docs/           Architecture write-up and diagrams

License

Licensed under the MIT License. One of the goals of this project is to contribute a working prototype to the open-source community — feel free to use, modify, and build on it.

Notes

This is a graduation project prototype, not a production-hardened tool — see docs/architecture.md for scope and design rationale. The full thesis (methodology, evaluation, and testing) is available on request.

Questions? Feel free to reach out at [email protected]