Packet Inspection Using A Hierarchical Pattern Matching Algorithm

Protocol capture tools and protocol analyzers are important tools for an information systems security professional. These utilities can be used to troubleshoot issues on the network. They can verify adherence to corporate policies, such as whether or not clear text privacy data is being sent on the network. They can be used to test security countermeasures and firewall deployments and are needed to perform audits, security assessments, network baseline definitions, and identification of rogue IP devices.

First, let’s talk about Wireshark, it is the most common network packet analyzer used worldwide, perhaps one of the best open source (free) packet analyzers today. It lets you capture and interactively browse the traffic running on a computer network, helping you analyze and manage the traffic in your network. Like a measuring device used to examine what is going on in your network cable, like a voltmeter used by an electrician to examine what is going on inside an electric cable. Therefore, gives you the tools to do in depth network analysis, it will try to capture network packets and display them as detailed as possible for analysis. Furthermore, used for troubleshooting network problems, examine security problems, debug protocol

Reflecting on several previous studies that have been carried out to compare the performance of the two NIDS, indicated Snort to be efficient in various issues. For instance, the comparison of Snort version 2.8.5.2 to Suricata version 1.0.2 was a clear indication of the strength of each system engine when subjected to the protection of the network. Their testbed incorporated the Ubuntu 10.04 which is a Virtual device accommodated on a VMWare Terminal 6.5 virtual setting operating on a 2.8GHz Quad-Core Intel Xeon CPU that had a 3GB RAM. The research was examining the quickness of detection and the accurateness of under changing rates of network and CPU usage (Albin, 2011). The control of the CPU used the Cpulimit with Tepreplay controlling the network bandwidth. The alert signals was accomplished by introducing six unknown malware that was created using the Metaspoilt framework. The results characterized Snort being efficient with system properties as compared to Suricata, but when functioning in a multi-CPU setting Suricata was extra efficient as a result of fewer false negatives

European Union Agency for Network and Information Security. (n.d.). ENISA. Retrieved May 31, 2014, from

tools will help to detect intrusions and other suspicious activities on the network. The third challenge is to improve the

For the purpose of this assignment snort will be used as intrusion detections systems which is an open source IDS, snort has the ability to monitor traffics in real time and packet locking its also inspecting each packets as they enters into the network, Snort can be used as packet sniffer to analyse the network traffic in order to detect any bizarre looking packets or payloads which might have malicious data in it. Snort can also detect payloads attacks against the network or host system including but not limited to stealth port scan, and buffer overflows.

In this paper, we present the first data collection and profiling process result in our research framework. At this time, the second and the third data collection process are still on going. If it is completed, we will conduct the second part of our proposed experiment. The challenges is, we have to obtain an appropriate and enough RAW data that need more prolonged time for trial and error. We have to design scalable devices and computation architecture, since the system proposed will handle high volume of traffic at national level network. A comment and suggestion are welcome.

Answer the following questions based on the packet capture that precedes them. You may research any of these on the Internet if you need to do so.

KDDCup99 dataset was introduced at the Third International Knowledge Discovery and Data Mining Tools Competition which was held by DARPA in 1999 .KDDCup99 is a refined data set from DARPA 1998 dataset as it contains only network data[3]. KDDCup99 is commonly used developers and implementers of new IDS to evaluate their systems. IDS systems take the KDDCup99 dataset as an input to train ,test the system and check performance of the IDS in classifying and detecting attack records. KDDCup99 dataset is used by most researchers because it contains 22 different attack types which could be classified into four main attack categories of the network discussed in the previous section. The full DARPA dataset consists of relatively 4,900,000 lines of connection vectors where each single connection vectors consists of 41 features and is marked as either normal or an attack, with exactly one particular attack type [38]. Among the 41 features of the connection, only sixteen significant attributes are considered which are: A1,A5,A6,A8, A9, A10, A11, A13, A16, A17, A18, A19, A23, A24, A32, A33[38] The KDD 99

After that, it uses the concept of Bloom filter. Bloom filter is a data structure used to test whether an element is a member of a given set or not. It has a two-dimensional bin table of k levels by m bins with k independent hash functions. It is used to keep track of the recent arrival rates of packets of different destination IP addresses passing through a router within a sampling period t as shown in fig. 4.2. In proposed system, it stores the IP address in data structure and checks it on the behalf of misuse detection method. Once whole of the information is derived, the complete data is analyzed statistically by using association between the nodes respective to the current node.

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

Despite its impact ping sweeps and port scans are best understood as a huge security threat on today's company's network system.

Internet Protocol (IP) datagrams may arrive in a seemingly random order of chunks that the receiving IP entity must continuously collect until it can reconstruct the original datagram. Consider that the receiving IP entity possesses a buffer for assembling the original datagram's data field. The buffer will comprise of chunks of data and "holes" between them corresponding to data not yet received.

The TCP/IP protocols are the heart and soul of the Internet, and they describe the fundamental rules that govern all communications in the network. The original address system of the Internet is Internet Protocol version 4 (IPv4). The Internet Engineering Task Force (IETF) developed IPv6 to deal with the long-anticipated problem of IPv4 address exhaustion. However, IPv6 is not foreseen to supplant IPv4 instantaneously.

Submitted in partial fulfillment of the requirements for the degree of Bachelor of Engineering in Computer Engineering