To add to the above, I also found a great "two liner" that sets up a docker container that spawns a security system called SLIPS that automatically detects and blocks suspicious network traffic in real time, without too much resource usage:

``` mkdir /home/ubuntu/dataset docker run -it --rm --net=host -v $(pwd)/dataset:/StratosphereLinuxIPS/dataset --cap-add=NET_ADMIN --name slips stratosphereips/slips:latest ./slips.py -c config/slips.conf -i eth0 -p ```