6 research outputs found
Using response action with Intelligent Intrusion detection and prevention System against web application malware
Findings: After evaluating the new system, a better result was generated in line with detection efficiency and the false alarm rate. This demonstrates the value of direct response action in an intrusion detection system
Implementation Of Intrusion Detection System Using Snort
Intrusion Detection System (IDS) is a vital network security tool for protecting the network systems that consists of software and hardware to monitor all the inbound and outbound network and system activities for malicious activities in the network traffic. The purpose of IDS is to assists the network administrator or the system by sending alerts and notifications when there are possible
incidents, which violations of computer security policies exist.
However, IDS causes a false alarm when attacker perform
modifications at the rules settings. Therefore, this study performs
experiment to detect anomaly incident and intruder in the network
system. The implementation on snort development is provided and
testing is executed in order to prove that snort capable to detect intruder. The findings showed that anomaly user can be detected based on port scanning, telnet to port to detect the unusual traffic and monitoring using NMAP to identify abnormal activities. As a result, the impact of Snort could bring an alternative solution on network monitoring in terms of continuous detection on unusual traffic movements, cost effective since Snort is an open source product and it can be customized to suit with the network environmen
Intrusion Detection and Countermeasure of Virtual Cloud Systems - State of the Art and Current Challenges
Clouds are distributed Internet-based platforms that provide highly resilient and scalable environments to be used by enterprises in a multitude of ways. Cloud computing offers enterprises technology innovation that business leaders and IT infrastructure managers can choose to apply based on how and to what extent it helps them fulfil their business requirements. It is crucial that all technical consultants have a rigorous understanding of the ramifications of cloud computing as its influence is likely to spread the complete IT landscape. Security is one of the major concerns that is of practical interest to decision makers when they are making critical strategic operational decisions. Distributed Denial of Service (DDoS) attacks are becoming more frequent and effective over the past few years, since the widely publicised DDoS attacks on the financial services industry that came to light in September and October 2012 and resurfaced in the past two years. In this paper, we introduce advanced cloud security technologies and practices as a series of concepts and technology architectures, from an industry-centric point of view. This is followed by classification of intrusion detection and prevention mechanisms that can be part of an overall strategy to help understand identify and mitigate potential DDoS attacks on business networks. The paper establishes solid coverage of security issues related to DDoS and virtualisation with a focus on structure, clarity, and well-defined blocks for mainstream cloud computing security solutions and platforms. In doing so, we aim to provide industry technologists, who may not be necessarily cloud or security experts, with an effective tool to help them understand the security implications associated with cloud adoption in their transition towards more knowledge-based systems
Intelligent zero-day intrusion detection framework for internet of things
Zero-day intrusion detection system faces serious challenges as hundreds of thousands of new instances of malware are being created every day to cause harm or damage to the computer system. Cyber-attacks are becoming more sophisticated, leading to challenges in intrusion detection. There are many Intrusion Detection Systems (IDSs), which are proposed to identify abnormal activities, but most of these IDSs produce a large number of false positives and low detection accuracy. Hence, a significant quantity of false positives could generate a high-level of alerts in a short period of time as the normal activities are classified as intrusion activities. This thesis proposes a novel framework of hybrid intrusion detection system that integrates the Signature Intrusion Detection System (SIDS) with the Anomaly Intrusion Detection System (AIDS) to detect zero-day attacks with high accuracy. SIDS has been used to identify previously known intrusions, and AIDS has been applied to detect unknown zero-day intrusions. The goal of this research is to combine the strengths of each technique toward the development of a hybrid framework for the efficient intrusion detection system. A number of performance measures including accuracy, F-measure and area under ROC curve have been used to evaluate the efficacy of our proposed models and to compare and contrast with existing approaches. Extensive simulation results conducted in this thesis show that the proposed framework is capable of yielding excellent detection performance when tested with a number of widely used benchmark datasets in the intrusion detection system domain. Experiments show that the proposed hybrid IDS provides higher detection rate and lower false-positive rate in detecting intrusions as compared to the SIDS and AIDS techniques individually.Doctor of Philosoph
A closer look at Intrusion Detection System for web applications
Intrusion Detection System (IDS) is one of the security measures being used
as an additional defence mechanism to prevent the security breaches on web. It
has been well known methodology for detecting network-based attacks but still
immature in the domain of securing web application. The objective of the paper
is to thoroughly understand the design methodology of the detection system in
respect to web applications. In this paper, we discuss several specific aspects
of a web application in detail that makes challenging for a developer to build
an efficient web IDS. The paper also provides a comprehensive overview of the
existing detection systems exclusively designed to observe web traffic.
Furthermore, we identify various dimensions for comparing the IDS from
different perspectives based on their design and functionalities. We also
provide a conceptual framework of an IDS with prevention mechanism to offer a
systematic guidance for the implementation of the system specific to the web
applications. We compare its features with five existing detection systems,
namely AppSensor, PHPIDS, ModSecurity, Shadow Daemon and AQTRONIX WebKnight.
The paper will highly facilitate the interest groups with the cutting edge
information to understand the stronger and weaker sections of the web IDS and
provide a firm foundation for developing an intelligent and efficient system