Detection Intrusion Prevention Systems Research Articles

PETRAK: A solution against DDoS attacks in vehicular networks

In recent years, the frequently reported incidents of Distributed Denial of Service assaults on vehicular networks in various countries have made researchers find new protective solutions. DDoS attacks can propagate through the charging points for electric vehicles in a charging station and affect the production of critical infrastructures such as electric grids. Existing solutions are efficient in attack detection; however, current systems do not offer multi-level protection, and zero-day vulnerabilities are prone to escape from the detection systems.In this paper, we address the problems mentioned above and introduce the first Machine Learning (ML)–based DDoS protective solution to combine prevention and detection mechanisms in vehicular networks. To be more specific, our proposed model is the first to consider the adaptive traffic threshold to generate the alarm for a suspicious amount of traffic flow in an Intrusion Detection Prevention System (IDPS). We call our proposed approach Protecting vEhicular neTworks against distRibuted deniAl of service attacKs (PETRAK). PETRAK uses four functions: prevention, alarm, training, and detection. The alarming system uses the flow parameters and activates the detection module to detect malicious packets. The prevention system works in two modes: immediate and future. PETRAK uses logistic regression to identify incoming packets and signatures of malicious packets to prevent future attacks. We also show that our proposed model is implacable towards advanced post-quantum cryptography-based traffic and also able to analyse side-channel attacks. We run a comprehensive set of experiments to test PETRAK on our synthesized dataset, KDDCUP’99 dataset, CIC-MalMem-2022, and the ToN-IoT dataset. We observe that PETRAK shows an accuracy of 99%. The results claim the efficiency of PETRAK in detecting and preventing DDoS attacks in vehicular networks.

Intrusion Detection Prevention System Security Design With Encrypted Passwords and Secure Shell Crypto Keys

Intrusion Detection Prevention System Security Design With Encrypted Passwords and Secure Shell Crypto Keys

Vulnerability assessment of android instant messaging application and network intrusion detection prevention systems

The amount of data, due to the quantum leap of technology, generated, processed, transmitted and stored is huge, heterogeneous, unconditional and unpredictable. The data exchanging using smart devices communication is rapidly enhancing so for effective and efficient data transmissions are very essential. The instant massage applications are very highly used applications for exchanging the information hence it is very essential for instant messaging application to be vulnerability free applications. In this paper a detailed study is discussed on vulnerability assessment in instant Messaging applications as well as also discusses intrusion detection prevention methodologies. In the view of data leakage detection, instant massage exchanging and contact details storage can be examined for each application. In this work a comprehensive reverse engineering is discussed with different smart phones and mobile OS. Smart phones are the most popular and useable communication device in which different types of data are processed by which it can be classified as public and private. It is a very essential concept to evaluate the applications that are used to infiltrate very sensitive data from smart phones such as contact details, location details, communication massage data, pictures and other confidential information. It is necessary to deploy a vulnerability protected system in smart phones which prevent the data leakage from malicious applications. The major challenge in to save the data and protect the access control system when the system transfers the data through data exchanging applications. Malicious applications can access the control and causes data leakage. In this paper the smart phone based instant messaging applications evaluated and examines the data leakage. For this Android based smart phones chosen with a dedicated vulnerability assessment tool kit. In this paper vulnerability assessment and simulation are discussed in detail so that instant messaging applications become more secured and free from vulnerability.

Shield Advanced Mitigation System of Distributed Denial of Service Attack in integration of Internet of Things and Cloud Computing Environment

Cloud services among public and business companies have become popular in recent years. For production activities, many companies rely on cloud technology. Distributed Denial of Services (DDoS) attack is an extremely damaging general and critical type of cloud attacks. Several efforts have been made in recent years to identify numerous types of DDoS attacks. This paper discusses the different types of DDoS attacks and their cloud computing consequences. Distributed Denial of Service attack (DDoS) is a malicious attempt to disrupt the normal movement of a targeted server, service or network through influx of internet traffic overwhelming the target or its infrastructure. The use of multiple affected computer systems as a source of attacks makes DDoS attacks effective. Computers and other networked tools, including IoT phones, may be included on exploited machines. A DDoS attack from a high level resembles a traffic jam that is caused by roads that prevents normal travel at their desired destination. So DDoS Attack is a major challenging problem in integrated Cloud and IoT. Hence, this paper proposes Shield Advanced Mitigation System of Distributed Denial of Service Attack in the integration of Internet of Things and Cloud Computing Environment. This secure architecture use two verification process to identify whether user is legitimate or malicious. Dynamic Captcha Testing with Equal Probability test for first verification process, moreover Zigsaw Image Puzzle Test is used for second verification process, and Intrusion Detection Prevention System is used to identify and prevent malicious user, moreover reverse proxy is used to hide server location. These functional components and flow could strengthen security in Client side network to provide cloud services furthermore to overcome distributed denial of service attack in the integration of Internet of Things and Cloud Environment.

FGSA for optimal quality of service based transaction in real-time database systems under different workload condition

A Real-Time Database System is referred to as a transaction execution system which is administered to manage different workloads. To store and to retrieve data onto distinctive application services database systems are utilized. Unfortunately, in most situations, Quality of Service (QoS) and security are detected separately. In order to overcome the issues an efficient real-time database system is introduced, which mainly focused on the optimization of QoS requirement (response time) as well as security strength by arbitrarily changing the security mechanisms (IDPSs) based upon the request from users. To achieve this goal, here we propose a Firefly Gravitational Search Algorithm (FGSA) to optimize the user requesting security policies under different workloads (number of user requests). The database system suffers from intrusion (attack) due to more number of users requesting for the security policies at a time. Due to this, the security of the database system may be decreased. To enhance this, combination (mix) of IDPSs (Intrusion Detection Prevention Systems) is utilized. In our environment, the number of used IDPSs is adopted to represent the effectiveness of the database system. From the simulation result, it is verified that FGSA shows better performance when compared to the existing algorithms in terms of the security strength, response time, IGD as well as with the fitness measure.

IMPLEMENTASI KEAMANAN SERVER PADA JARINGAN WIRELESS MENGGUNAKAN METODE INTRUSION DETECTION AND PREVENTION SYSTEM (IDPS) (STUDI KASUS : TECHNO'S STUDIO)

The use of computer networks uses the current wireless media that provides significant information that allows others to access the connection because they do not use cables. Techno's Studio is a company engaged in technology and is a company that uses wireless technology as one of the important components in the activities of everyday employees. Therefore, server security issues on wireless networks become very important, because without any security support can lead to system failure and can be a gap in the occurrence of hacking. The IDPS method (Intrusion Detection & Prevention System) is used as an attack detection and prevention system by blocking Internet Protocol (IP) attackers. The results obtained from this research is the use of Snort and IPTables as a server security system on the wireless network successfully overcome the type of attack on ICMP ports, FTP, SSH, TELNET, and HTTP using various tools of attackers such as angry IP scanner, FileZilla , Putty, Mozilla Firefox, and Zenmap. Keywords — Server, Wireless, Intrusion Detection & Prevention System (IDPS), Snort, IPTables DOI: 10.5281/zenodo.1407864

A novel honeypot based security approach for real-time intrusion detection and prevention systems

In the digitalized modern world in parallel to the new technological developments, information security has become the highest priority in the individual and institutional sense. In order to ensure the security of information systems, various systems are used techniques and technologies, including encryption, authorization, firewall, honeypot based systems. In this study, a honeypot based approach for intrusion detection/prevention systems (ID/PS) is proposed. The developed honeypot server application is combined with IDSs to analyze data in real-time and to operate effectively. Moreover, by associating the advantages of low and high-interaction honeypots, a superior hybrid honeypot system is performed. Therefore, in order to reduce the cost of configuration, maintenance, and management, after viewing the usage of honeypots on corporate networks, virtualization technologies are used. The developed system is a honeypot based intrusion detection and prevention system (IDPS) type and it is able to show the network traffic on servers visually in real-time animation. Thereby, it provides system information easily. Finally, the developed system can detect zero-day attack due to the configuration of intrusion detection, which makes it superior in performance compared to other IDSs. This system also helps in reducing the false positive level in IDSs.

Fog-Assisted SDN Controlled Framework for Enduring Anomaly Detection in an IoT Network

Extensive adoption of intelligent devices with ubiquitous connectivity has increased Internet of Things (IoT) traffic tremendously. The smart devices promise to improve human life through improved safety and security through the implementation of intelligent transportation systems, optimization of power grids, and applications in human health. Devices produce a large amount of data for analytic applications running inside a cloud infrastructure. Unlike core networks, the main objective of an attack on an IoT network is to disrupt the availability of IoT data for the applications by overwhelming devices with information requests. Detection of such an attack cannot be done either in the cloud where the analytical application runs nor on the IoT device itself due to its limited computational resources. Furthermore, the standard networking paradigm does not provide an easy way to instrument and control networking nodes, for an effective mitigation of identified threats. In this paper, we propose a fog-assisted software defined networking (SDN) driven intrusion detection/prevention system (IDPS) for IoT networks. A collocated fog computational arrangement with IoT network equips proposed IDPS for timely identification of various attack models in near real time for effective neutralization of threats using SDN control. We have found our approach more effective from traditional techniques of intrusion detection in the IoT network.

Big Data in Intrusion Detection Systems and Intrusion Prevention Systems

This paper introduces network attacks, intrusion detection systems, intrusion prevention systems, and intrusion detection methods including signature-based detection and anomaly-based detection. Intrusion detection/prevention system (ID/PS) methods are compared. Some data mining and machine learning methods and their applications in intrusion detection are introduced. Big data in intrusion detection systems and Big Data analytics for huge volume of data, heterogeneous features, and real-time stream processing are presented. Challenges of intrusion detection systems and challenges posed by stream processing of big data in the systems are also discussed.

Advocating for Hybrid Intrusion Detection Prevention System and Framework Improvement

The network systems of the world are fragile, and can come under attack from any source. The attack can be a denial-of-service (DoS) state or another type of threat. What keep the networks safe are the intrusion detection and prevention systems (IDPS). They constantly monitor network traffic and if a malicious threat is detected, the threat is blocked and reported for further analysis. However, every defensive system must always have some type of weakness. False negatives and false positives are some examples of how IDPS can fail to protect the network. In another instance, a skilled attacker may employ Direct Kernel Object Modification (DKOM) to trick the IDPS into detecting no malicious activities. The IDPS is strong, yet not strong enough. This paper presents a hybrid solution that incorporates both signature and anomaly based systems to detect and prevent more malicious attacks by intensifying what is cataloged to include common anomalies to the baselines used by the signature based systems. We also propose an improvement in the framework to current Host IDPS/Network using signature and anomaly based methodologies by implementing a hybrid VMM-based Honeypot into a theorized self-healing hybrid IDPS to further boost their advantages in efficiency and accuracy.

Artificial Intrusion Detection Techniques: A Survey

Networking has become the most integral part of our cyber society. Everyone wants to connect themselves with each other. With the advancement of network technology, we find this most vulnerable to breach and take information and once information reaches to the wrong hands it can do terrible things. During recent years, number of attacks on networks have been increased which drew the attention of many researchers on this field. There have been many researches on intrusion detection lately. Many methods have been devised which are really very useful but they can only detect the attacks which already took place. These methods will always fail whenever there is a foreign attack which is not famous or which is new to the networking world. In order to detect new intrusions in the network, researchers have devised artificial intelligence technique for Intrusion detection prevention system. In this paper we are going to cover what types evolutionary techniques have been devised and their significance and modification.

A Recent Analysis of Intrusion Detection and Prevention System for Protecting Range of Attack using Data Gathering Technique in MANET

Ad-hoc Network (MANET) is a mobile and multi- hop autonomous operation of wireless network. Collection of wireless mobile nodes way of forms a temporary network without using any pre-existing infrastructures. Intrusion Detection & Prevention System (IDPS) is one of the defence mechanisms to protect MANET against variety of attacks due to the dynamic topology, lack of centralized control, limited physical security and energy constrained operations. This paper aims to focus on monitored the most prominent techniques of IDS approach for determining under the conditions of critical nodes and also trigger & compare the recent Intrusion Detection mechanism based on their architecture and data gathering techniques.

Hardware Realization of Artificial Neural Network Based Intrusion Detection & Prevention System

In the 21st century with the exponential growth of the Internet, the vulnerability of the network which connects us is on the rise at a very fast pace. Today organizations are spending millions of dollars to protect their sensitive data from different vulnerabilities that they face every day. In this paper, a new methodology towards implementing an Intrusion Detection & Prevention System (IDPS) based on Artificial Neural Network (ANN) onto Field Programmable Gate Array (FPGA) is proposed. This system not only detects different network attacks but also prevents them from being propagated. The parallel structure of an ANN makes it potentially fast for the computation of certain tasks. FPGA platforms are the optimum and best choice for the modern digital systems nowadays. The same feature makes ANN well suited for implementation in FPGA technology. Hardware realization of ANN to a large extent depends on the efficient implementation of a single neuron. However FPGA realization of ANNs with a large number of neurons is still a challenging task. The proposed multilayer ANN based IDPS uses multiple neurons for higher performance and greater accuracy. Simulation of the design in MATLAB SIMULINK 2010b by using Knowledge Discovery and Data Mining (KDD) CUP dataset shows a very good performance. Subsequently MATLAB HDL coder was used to generate VHDL code for the proposed design that produced Intellectual Property (IP) cores for Xilinx Targeted Design Platforms. For evaluation purposes the proposed design was synthesized, implemented and tested onto Xilinx Virtex-7 2000T FPGA device.

GPU Application on Multi-Pattern Matching of Network Intrusion Detection

With the development of wire/wireless network applications, numerous network attacks and security threats have brought great attention to all of us. Fast processing network traffic to the exclusion of malicious packets becomes increasingly important. Intrusion Detection/Prevention System (IDPS) is a network security system that monitors networks or system activities for malicious and unwanted behaviors without breaking the network traffic.In this paper, we study a kernel component of most IDPS, multi-pattern matching by exploiting two wellknown algorithms, namely Wu-Manber and Aho-Corasick. For this purpose, we implement both algorithms over Graphic Processing Units (GPU) to speed up the malicious packet detection. Extensive experiments are conducted to compare the performance of our implementations on both CPU and GPU. Our experimental results show that the throughput of GPU implementation is about four times faster than CPU. Therefore, on the basis of considering the lower cost, easy expansion and better performance, rather than specific hardware, such as ASIC, TCAM, Bloom Filter, and so on, IDPS over GPU offers an attractive solution to speed up malicious packets detection among the normal traffic.

MLDW- A MultiLayered Detection mechanism for Wormhole attack in AODV based MANET

Wormhole attack is one of the serious routing attacks amongst all the network layer attacks launched on MANET. Wormhole attack is launched by creation of tunnels and it leads to total disruption of the routing paths on MANET. In this paper, MLDWa multilayered Intrusion Detection Prevention System approach is proposed to detect and isolate wormhole attack on MANET. The routing protocol used is Adhoc On Demand Distance Vector (AODV). MLDW has a layered framework consisting of link latency estimator, intermediate neighbor node discovery mechanism, packet drop calculator, node energy degrade estimator followed by isolation technique. MLDW effectiveness is evaluated using ns2 network simulator.