Design and Development of a Deep Packet Inspection Simulator for the Detection and Identification of Malicious Network Traffic

Abstract

The increasing complexity and frequency of cyber threats have highlighted the need for effective network traffic monitoring and threat detection mechanisms. Conventional network monitoring techniques that rely solely on packet header inspection are no longer sufficient to identify sophisticated cyber attacks hidden within packet payloads. This study aims to design and develop a Deep Packet Inspection (DPI) simulator capable of detecting and identifying malicious network traffic in a controlled environment as an educational platform for cybersecurity training and network security evaluation. The research employed a Research and Development (R&D) approach using an iterative prototyping model. The simulator was developed by integrating Suricata as the intrusion detection engine, libpcap and Scapy for packet capturing and traffic generation, and EveBox as a web-based monitoring dashboard. Experimental evaluations were conducted in an isolated laboratory network using both normal and malicious traffic datasets, including port scanning, SYN flood (DDoS), ICMP flood, and SSH brute-force attacks. System performance was evaluated using detection accuracy, precision, recall, throughput, and latency metrics. The experimental results demonstrate that the developed simulator successfully detected various malicious traffic patterns in real time while providing clear visualization of security alerts through the monitoring dashboard. Furthermore, the simulator offers a practical and cost-effective platform for understanding Deep Packet Inspection technology and evaluating intrusion detection mechanisms without affecting operational networks. Therefore, the proposed simulator can serve as an effective educational tool for cybersecurity training and as a foundation for further research on intelligent network traffic analysis and cyber defense systems.