Intrusion Detection System For A Network And Deal With Enormous Amount Of Network Traffic

tools will help to detect intrusions and other suspicious activities on the network. The third challenge is to improve the

For the purpose of this assignment snort will be used as intrusion detections systems which is an open source IDS, snort has the ability to monitor traffics in real time and packet locking its also inspecting each packets as they enters into the network, Snort can be used as packet sniffer to analyse the network traffic in order to detect any bizarre looking packets or payloads which might have malicious data in it. Snort can also detect payloads attacks against the network or host system including but not limited to stealth port scan, and buffer overflows.

KDDCup99 dataset was introduced at the Third International Knowledge Discovery and Data Mining Tools Competition which was held by DARPA in 1999 .KDDCup99 is a refined data set from DARPA 1998 dataset as it contains only network data[3]. KDDCup99 is commonly used developers and implementers of new IDS to evaluate their systems. IDS systems take the KDDCup99 dataset as an input to train ,test the system and check performance of the IDS in classifying and detecting attack records. KDDCup99 dataset is used by most researchers because it contains 22 different attack types which could be classified into four main attack categories of the network discussed in the previous section. The full DARPA dataset consists of relatively 4,900,000 lines of connection vectors where each single connection vectors consists of 41 features and is marked as either normal or an attack, with exactly one particular attack type [38]. Among the 41 features of the connection, only sixteen significant attributes are considered which are: A1,A5,A6,A8, A9, A10, A11, A13, A16, A17, A18, A19, A23, A24, A32, A33[38] The KDD 99

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

The Intrusion Detection System (IDS) is a protection scheme which collect and analyze audit data for the entire network.

These proposals and systems suggestions can minimize the vulnerabilities associated with any compromises or intrusions within the network. Deploying an intrusion detection system is an essential security strategy for monitoring a network information system for abnormal or authorized activity. An intrusion detection system (IDS) is set of tools which monitor a network topology by providing a system administrator with the overall picture of how the system is being utilized. Executing an IDS will make a difference in creating a defense in depth architecture to be more compelling in recognizing any form of malicious activities. The capacity of the IDS is to monitor and survey the network traffic without affecting network activity. IDS tools gather information and analyzes it against a pre-characterized manage set, and against a set of known assault 'marks'. The IDS can scan port numbers and to determine if any breaches or attacks are occurring (Kuipers,

* The Intrusion Detection System (IDS) provides the network with a level of preventive security against any suspicious activity. The IDS achieves this objective through early warnings aimed at systems administrators. However, unlike IPS, it is not designed to block attacks.

PHAD and Snort are evaluated on 1999 DARPA off-line IDS evaluation data set. They consist of tcpdump files. The week 3, 4 and 5 results are used as inputs. Week 3 is attack free. Week 4 and 5 data consist of attacks and are used in testing. Comparison between PHAD and Snort can be done using three parameters:-

Cyber-attacks intruding network systems is a threat the economy, national and public safety. Computer system pirates are the possible persons who can form groups that can attack the nation and cause the negative impact to the country's attack. More research should be done in the networking area to monitor systems performance and detect any malice attacks as soon as possible with correct advanced measures taken to solve the problems.

Even the focus of securing networks has moved from just intrusion detection to intrusion detection and prevention (Golomb, 2003). Although most companies have significant investments in physical security (security guards and laptop locks) and data security (IDS/IPS and firewalls), one of the biggest and yet most misunderstood threats is from internal sources.

The goal of intrusion detection is to monitor network assets, detect anomalous behavior, and identify misuse within a network (Ashoor, Gore, 2011). An intrusion detection system (IDS) is a device or software application that monitors network system activities for malicious activity or policy violations and produces reports to a management station (Kashyap, Agrawal, Pandey, Keshri, 2013), additionally there are three types of IDS:

Intrusion Detection Systems – IDS should be installed that contain the capabilities to monitor the network and send alerts if odd or different behavior is observed.

2)In addition, intrusions very often represent sequence of events and therefore are more suitable to be addressed by some temporal data mining algorithms. Finally, misuse detection algorithms require all data to be labeled, but labeling network connections as normal or intrusive re-quires enormous amount of time for many human experts. All these issues cause building misuse detection models very complex

Configuration of Intrusion Detection (IDS) and Prevention System (IPS) for monitoring and preventing the attacks

Firewalls is categorized as a preventive control which is used as a defense shield around IT systems to keep intruders and hacking from occurring, whereas, an Intrusion Detection System (IDS) which is categorized as a detective control is used to detect intrusions that have already occurred (Cavusoglu, Mishra, & Raghunathan, 2005). However, IDSs are not