Security Enhancement Strategies And Strategies

Despite the presence of network security devices such as firewalls and other security appliances, today's corporate networks are still vulnerable to both internal and external attacks by hackers intent on creating havoc. By proactively

tools will help to detect intrusions and other suspicious activities on the network. The third challenge is to improve the

Segregation of affected system as soon as possible and investigation begins to establish the amount of damage.

For the purpose of this assignment snort will be used as intrusion detections systems which is an open source IDS, snort has the ability to monitor traffics in real time and packet locking its also inspecting each packets as they enters into the network, Snort can be used as packet sniffer to analyse the network traffic in order to detect any bizarre looking packets or payloads which might have malicious data in it. Snort can also detect payloads attacks against the network or host system including but not limited to stealth port scan, and buffer overflows.

Where coursework, other than a Master’s dissertation or Master’s project, is handed in late and there are no valid mitigating circumstances, the

KDDCup99 dataset was introduced at the Third International Knowledge Discovery and Data Mining Tools Competition which was held by DARPA in 1999 .KDDCup99 is a refined data set from DARPA 1998 dataset as it contains only network data[3]. KDDCup99 is commonly used developers and implementers of new IDS to evaluate their systems. IDS systems take the KDDCup99 dataset as an input to train ,test the system and check performance of the IDS in classifying and detecting attack records. KDDCup99 dataset is used by most researchers because it contains 22 different attack types which could be classified into four main attack categories of the network discussed in the previous section. The full DARPA dataset consists of relatively 4,900,000 lines of connection vectors where each single connection vectors consists of 41 features and is marked as either normal or an attack, with exactly one particular attack type [38]. Among the 41 features of the connection, only sixteen significant attributes are considered which are: A1,A5,A6,A8, A9, A10, A11, A13, A16, A17, A18, A19, A23, A24, A32, A33[38] The KDD 99

Network Intrusion Detection: Software exists to watch traffic on your network to search for malicious intent. Is an Intrusion Detection System going to be implemented? An IDS is not a fire and forget type system. It requires constant monitoring. Smaller organizations will be overwhelmed by the amount of information it produces.

When the GCU gathers evidence for later use for the court, sources of evidence can be monitored to detect threatened incidents in a timely manner. The GCU employee’s needs to be aware of suspicious transaction related to any activity in the customer account. Securing intrusion detection systems (IDS) components are important because IDS are often targeted by attackers that want to prevent the IDS from detecting attacks or want to gain access to sensitive information on the IDS, such as host configurations and known vulnerabilities. In monitoring and auditing, the types of activities recognized as suspicious will be different from different business needs. For example, a forensic accountant may look for specific patterns of financial data to trigger suspicion of fraud or theft. A suspicious event might be multiple emails on a sensitive subject from a person that is not involved in the subject. Recommend resources that can be used

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

Host based IDS – monitors a computer system on which it is installed in order to detect intrusion or misuse by analyzing several types of logs files including kernel, system, server, network and firewall logs, and compares logs with signatures for known attacks.

In this fast-paced technology era, organizations are always looking for new innovative ways to increase productivity and efficiency. One emerging technology adopted by many organisations is cloud computing. Cloud computing is a model that uses internet and remote servers for maintaining data and applications (Association of Modern Technologies Professionals 2017). It replaces expensive infrastructure and need of maintenance. Cloud provides access to data anytime, anywhere over the internet. However, like any cyber technology cloud computing is vulnerable to various kinds of cyber-attacks (Amna Riaz 2017).

Firewalls is categorized as a preventive control which is used as a defense shield around IT systems to keep intruders and hacking from occurring, whereas, an Intrusion Detection System (IDS) which is categorized as a detective control is used to detect intrusions that have already occurred (Cavusoglu, Mishra, & Raghunathan, 2005). However, IDSs are not

Anomaly-Based techniques attempt to detect computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous [1]. Anomaly based detection techniques helps to solve the issue of detecting unknown bots based on the anomalies such as high network latency, traffic on unusual ports, high volumes of traffic, and unusual system behavior [1]. Nevertheless this technique meets the problem of detecting unknown botnets [1,2]. Anomaly based detection techniques are classified into two categories: host-based and network based techniques [2].

To perform adaptive cyber-security analytics using a computer implemented method that includes receiving a report on a network activity, It works as follows, a scoring method is used wherein a score responsive to the network activity is calculated. The score indicates a likelihood of security breach. The score is validated and the scoring model is automatically updated responsive to results of the validating. If the score falls within a threshold value of a security violation rule, the network activity is reported as suspicious. This basically relates generally to cyber-security monitoring, and more particularly to monitoring incoming security events to determine if any activity is violating

Keywords: Cloud Computing, Security treats, Cloud service user, Cloud service provider, security challenges, cloud computing, threat and countermeasures