Network Security Monitor

Enterprise-grade network monitoring and security suite

A comprehensive network discovery and security monitoring tool that transforms complex network analysis into user-friendly insights. Monitor your home network, secure your business infrastructure, or perform professional IT operations with a simple, intuitive interface.

Overview

Network Security Monitor provides automated network discovery, security analysis, and real-time monitoring capabilities. The application features a modern web-based dashboard, multi-format reporting, and comprehensive threat detection suitable for home users, small businesses, and IT professionals.

Core Capabilities

• Network Discovery: Automated device detection with hostname resolution and MAC vendor lookup
• Security Monitoring: Real-time threat detection with risk scoring and vulnerability assessment
• Device Identification: Automatic classification of device types (computers, phones, IoT devices, printers, etc.)
• Health Scoring: Visual network health indicators with color-coded status
• Professional Reporting: Export capabilities in CSV, JSON, XML, and HTML formats
• Web Dashboard: Modern, responsive interface accessible from any browser

Use Cases

Home Users

• Monitor all devices connected to your WiFi network
• Receive alerts when unknown devices join your network
• Track family device usage and connectivity
• Manage smart home devices and monitor IoT security

Small Businesses

• Automated network asset inventory and tracking
• Security compliance reporting for audits
• Network performance monitoring and optimization
• Early warning system for potential security threats

IT Professionals

• Enterprise-level network analysis and monitoring
• Advanced security operations and threat detection
• Programmatic access via REST API for automation
• Historical trend analysis and forensic capabilities

Key Features

Network Discovery

• Multi-threaded scanning with configurable thread pools
• Hostname resolution and MAC address vendor identification
• Port scanning with configurable port lists
• Network topology mapping
• Device change tracking and history

Security Monitoring

• Network health scoring (0-100 scale)
• Threat detection with configurable risk assessment
• Vulnerability scanning for open ports and exposed services
• Multi-channel alerting (Email, Slack, Discord)
• Device and vendor whitelisting

Professional Reporting

• Multiple export formats: CSV, JSON, XML, HTML
• Security compliance reports
• Historical trend analysis
• Custom dashboards and analytics
• RESTful API for system integration

User Interface

• Web-based dashboard with real-time updates
• Beginner and expert modes
• Mobile-responsive design
• Visual health indicators (Green/Yellow/Red)
• Custom device naming and categorization

Quick Start

Installation

Prerequisites:

• Python 3.7 or higher
• Administrator/root privileges (recommended for full functionality)

Step 1: Clone the repository

git clone https://github.com/marttinm/network-security-monitor.git
cd network-security-monitor

Step 2: Install dependencies

pip install -r requirements.txt

Or install core dependencies manually:

pip install flask flask-socketio

Step 3: Launch the application

python main.py

The web dashboard will automatically open in your default browser at http://localhost:5000.

Basic Usage

Once the web interface is running:

1. Start Scanning: Click the "Scan Network" button to discover devices
2. View Results: Devices will appear in real-time with status indicators
3. Monitor Security: Check the health score and security alerts
4. Export Data: Download reports in your preferred format (CSV, JSON, XML, HTML)
5. Configure Settings: Adjust scan parameters and alert preferences in the Settings panel

Configuration

Web Interface Configuration

All settings can be managed through the web dashboard:

• Navigate to Settings in the top navigation
• Adjust parameters using intuitive controls
• Save changes to persist configuration

Configuration Files

Advanced users can edit configuration files directly:

• config.json - Main application settings
• config/app_config.json - Advanced application configuration
• config/threat_intel.json - Threat intelligence sources

Key Configuration Options

• Scan Parameters: Thread count, timeout values, port ranges
• Security Settings: Risk thresholds, whitelist management
• Alert Configuration: Email, Slack, Discord integration
• Data Retention: History storage duration and cleanup policies
• Performance Tuning: Resource allocation and optimization settings

Understanding Network Health

Health Score Interpretation

• 90-100: Excellent - Network is secure and optimized
• 75-89: Good - Minor issues, generally secure
• 60-74: Fair - Some security concerns requiring attention
• 40-59: Poor - Multiple issues requiring immediate action
• 0-39: Critical - Serious security risks detected

Device Risk Levels

• 1-3: Low risk (normal, trusted devices)
• 4-6: Medium risk (requires attention)
• 7-8: High risk (security concern)
• 9-10: Critical risk (immediate action required)

Export and Reporting

Available Export Formats

All reports can be exported from the web interface:

• CSV - Spreadsheet compatible, suitable for data analysis
• JSON - Machine-readable format for API integration
• XML - Enterprise system compatibility
• HTML - Formatted reports with embedded charts and styling

Report Types

• Device Inventory - Complete list of discovered devices with details
• Security Analysis - Vulnerability assessment and risk scores
• Historical Trends - Device changes and network evolution over time
• Network Health - Performance metrics and optimization recommendations
• Alert Summary - Security events and triggered notifications

Security and Privacy

Data Privacy

• Local Processing: All data remains on your local system
• No External Transmission: Network data is not sent to external servers
• Optional Threat Intelligence: External threat feeds are opt-in only
• Encrypted Storage: Sensitive data is protected at rest

Security Best Practices

• Authorization: Only scan networks you own or have permission to monitor
• Compliance: Follow local laws and regulations regarding network scanning
• Responsible Disclosure: Report discovered vulnerabilities appropriately
• Regular Updates: Keep the application updated for security patches

Required Permissions

• Network Access: Read access to network interfaces and ARP tables
• Administrator Privileges: Recommended for full scanning capabilities
• Firewall Exceptions: May be required for port scanning features

Architecture

Project Structure

network_monitor/
├── core/                    # Core functionality
│   ├── config.py           # Configuration management
│   ├── device.py           # Device data structures
│   └── scanner.py          # Multi-threaded network scanning
├── interfaces/             # User interfaces
│   └── cli.py              # Command-line interface
├── security/               # Security monitoring
│   └── monitor.py          # Threat detection and analysis
├── intelligence/           # Threat intelligence
│   └── threat_feeds.py     # External threat data integration
├── utils/                  # Utility modules
│   ├── alerts.py           # Multi-channel alerting
│   ├── database.py         # SQLite operations
│   ├── export.py           # Multi-format export
│   ├── mac_vendor.py       # MAC address lookup
│   ├── network.py          # Network utilities
│   └── topology.py         # Topology mapping
├── web/                    # Web interface
│   └── interface.py        # Flask-based dashboard
├── config/                 # Configuration files
├── data/                   # Database and persistent storage
├── results/                # Export outputs
└── tests/                  # Test suite

Technology Stack

Core:

• Python 3.7+ standard library
• SQLite for data persistence
• Multi-threading for performance

Web Interface:

• Flask web framework
• Flask-SocketIO for real-time updates
• Responsive HTML/CSS/JavaScript

Optional Enhancements:

• python-nmap for advanced scanning
• requests for threat intelligence
• Email/Slack/Discord integration libraries

Testing and Quality Assurance

Test Suite

The project includes a comprehensive test suite with 29+ test cases covering:

• Network scanning and device discovery
• Security monitoring and threat detection
• Database operations and persistence
• Export functionality (all formats)
• Configuration management
• API endpoints and web interface

Running Tests

# Run all tests
python -m pytest tests/

# Run specific test file
python -m pytest tests/test_device_editing.py

# Run with verbose output
python -m pytest tests/ -v

# Run with coverage report
python -m pytest tests/ --cov=network_monitor

Troubleshooting

Common Issues

No devices found:

# Run with administrator/root privileges
# Windows: Right-click → "Run as administrator"
# Linux/macOS:
sudo python main.py

Web dashboard won't start:

# Install Flask dependencies
pip install flask flask-socketio

Permission errors:

• Check firewall settings
• Verify network interface access permissions
• Ensure application has network scanning privileges

Slow scanning performance:

• Adjust thread count in configuration
• Increase timeout values for slower networks
• Reduce port scanning range

Getting Support

1. Check the documentation and configuration files
2. Review log files in the logs/ directory
3. Verify system permissions and firewall settings
4. Consult the issue tracker on GitHub

Contributing

Contributions are welcome! Please follow these guidelines:

Development Setup

# Fork and clone the repository
git clone https://github.com/yourusername/network-security-monitor.git
cd network-security-monitor

# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install development dependencies
pip install -r requirements.txt
pip install pytest black flake8

# Run tests to verify setup
python -m pytest tests/

Code Standards

• Follow PEP 8 style guidelines
• Add type hints for new functions
• Include docstrings for modules, classes, and functions
• Write unit tests for new features
• Update documentation as needed

Submitting Changes

1. Create a feature branch from main
2. Make your changes with clear commit messages
3. Ensure all tests pass
4. Update documentation if needed
5. Submit a pull request with a detailed description

Areas for Contribution

• Additional device type detection patterns
• Enhanced threat intelligence sources
• Performance optimizations
• Additional export formats
• UI/UX improvements
• Documentation enhancements
• Bug fixes and issue resolution

Author

Martin Marchetto - marttinm

This project was created as a hobby to learn Python and cybersecurity concepts. It started as a simple device listing script and evolved into a comprehensive network security monitoring suite. I hope others find this tool useful for their network monitoring and security needs.

License

This project is licensed under the MIT License. See the LICENSE file for details.

Copyright (c) 2025 Martin Marchetto

Acknowledgments

• Built with Python and Flask
• MAC vendor database from IEEE OUI registry
• Community contributors and testers
• Open-source security research community

Roadmap

Current Version Features

• Multi-threaded network scanning
• Web-based dashboard
• Security monitoring and alerting
• Multi-format reporting
• Device history tracking

Planned Enhancements

• Machine learning-based anomaly detection
• Mobile application (iOS/Android)
• Advanced network topology visualization
• Integration with SIEM systems
• Cloud-based threat intelligence
• Multi-network environment support
• Performance analytics and reporting

---

Network Security Monitor - Professional network monitoring made accessible.

For more information, visit the GitHub repository or check the documentation.