Intrusion Detection System Tools Research Articles

Организация мониторинга сетевых вторжений на основе свободно распространяемого программного обеспечения

This paper presents the results of preparing a virtual bench for modeling and detecting network attacks using a freely distributed intrusion detection system (IDS). The relevance of the work is related to the growing demand for IDS as sources of information security events for security information and event management (SIEM) systems. A comparative analysis of the most popular freely distributed open-source network IDSs was carried out and the choice of the Zeek system for its use in the project was substantiated. The work uses Zeek network logs, which contain important and structured information about the analyzed network traffic. The laboratory bench was built on the basis of a Linux virtual machine and a Mininet network simulator. A graphical representation of the developed virtual stand is proposed. An experimental study of the effectiveness of an intrusion detection system is demonstrated by simulating a network denial of service attack and further analyzing the received network traffic using IDS tools.

Intruder Detection Systems on Computer Networks Using Host Based Intrusion Detection System Techniques

The openness of access to information raises various problems, including maintaining the validity and integrity of data, so a network security system is needed that can deal with potential threats that can occur quickly and accurately by utilizing an IDS (intrusion detection system). One of the IDS tools that are often used is Snort which works in real-time to monitor and detect the ongoing network by providing warnings and information on potential threats in the form of DoS attacks. DoS attacks run to exhaust the packet path by requesting packets to a target in large and continuous ways which results in increased usage of CPU (central processing unit), memory, and ethernet or WiFi networks. The snort IDS implementation can help provide accurate information on network security that you want to monitor because every communication that takes place in a network, every event that occurs and potential attacks that can paralyze the internet network are monitored by snort.

A Comprehensive Systematic Literature Review on Intrusion Detection Systems

Effectively detecting intrusions in the computer networks still remains problematic. This is because cyber attackers are changing packet contents to disguise the intrusion detection system (IDS) recently. Besides, everyday a lot of new devices are added to the computer networks. These new devices are also raising security issues in the computer networks. To effectively manage the computer network flows and provide the security in advance; the components of the IDSs, the approaches and technologies that are used, the nature of the attacks, and the tools that are used needs to be examined deeply. This paper discusses intrusion detection technologies, methodologies, and approaches and also investigates new attack types, protection mechanisms, and recent scientific studies that have been made in this area. In addition, available datasets, well-known IDS tools, and advantages and disadvantages of particular IDSs are explained deeply. We believe that this scientific review study presents a road map for researchers and industry employees who focus on IDSs.

Intrusion Detection System

Intrusion Detection System (IDS) is well-defined as a Device or software application which monitors the system activities and finds if there is any malevolent activity that has occured. Unresolved growth and traditional use of internet raises anxieties about how to connect and protect the digital information securely. In today's world hackers use different types of attacks for getting the valued information. Many of the intrusion detection techniques, methods and procedures help to perceive those several attacks. The main objective of this paper is to provide a complete study about the intrusion detection, sorts of intrusion detection methods, types of attacks, diverse tools and practices, research needs, challenges and finally change the IDS Tool for Research Purpose That tool are capable of perceiving and prevent the attack from the intruder.

Integrated Intrusion Detection Approach for Cloud Computing

Objectives: Intrusion Detection System (IDS) models and methods are integrated for better detection of intruders and mitigation of false alarms. Integrated IDS is proposed to provide security in a cloud environment. Methods: The distributed and dynamic nature of cloud environment leads to critical issues like huge log analysis, heterogeneous traffic aggregation and scalability, etc. Intrusion specific data classification and false alarms degrades performance. This integrated model integrates both IDS models and IDS methodologies. Host-based IDS (H-IDS) model integrates with network-based IDS (N-IDS) model, as well as signature and anomaly based IDS methods are integrated to get the best of each. Findings: Whenever a Virtual Machine (VM) is created, H-IDS is in-built into its operating system to monitor the activities within that VM. N-IDS is deployed at strategic locations within the cloud network to monitor the traffic between the virtual machines and from the outside environment. Any malicious activity initiated by a cloud user using their virtual machine is detected by H-IDS. The packets flowing through the cloud network are captured and analyzed by N-IDS to detect infected packets send by hackers. The weakness of one methodology is compromised by the other during integration, but if the methods are used separately they are ineffective. Known attacks can be detected by signature based IDS and the new/unknown attack patterns are identified by anomaly based IDS. The major drawback of anomaly based IDS is high false alarm rate. It can be overcome by signature based IDS. This proposed work is implemented using Opennebula, for constructing a cloud environment and tested with IDS tools. Improvements: This integration leads to improve cloud security and trust among consumers. IDS specific issues are also rectified such as false alarms, heterogeneity etc.