DESIGN AND IMPLEMENTATION OF NETWORK INTRUSION DETECTION SYSTEM (NIDS)
- Project Research
- 1-5 Chapters
- Qualitative
- Content
- Abstract : Available
- Table of Content: Available
- Reference Style: APA
- Recommended for : Student Researchers
- NGN 3000
ABSTRACT
The objective of this project is to develop a network intrusion detection system that incorporates a decoy system, specifically a honeypot. This approach effectively addresses the challenges of false positives and false negatives, as they are not easily bypassed or overcome by new exploits. One of their notable advantages is their ability to potentially identify new compromises resulting from unfamiliar or unanticipated attacks, primarily through monitoring system activity rather than relying solely on signatures. Administrators can focus on their core responsibilities without the need to allocate time for updating signature databases or patching anomaly detection engines. Honeypots effectively capture various types of attacks directed towards them. This project work utilises the UML (Unified Modelling Language) object oriented design approach. The deliverables encompass the Use-case, class diagram, activity diagram, and sequence diagram. Key activities in system design involve the formulation of system-level technical requirements, the creation of top-level system designs, and the evaluation of the design's capacity to fulfil the system requirements. The system comprises various components, including the database design, class diagrams, use-case design, activity diagram design, input design, and output design. However, the honeyd.conf file was a bit challenging to understand. Even a minor typo in the script could prevent the configuration file from running smoothly. Nevertheless, the utilisation of honeypots enables researchers and security professionals to discreetly observe malicious attackers, with the aim of gaining insights into the most up-to-date techniques and exploits in real-time.
CHAPTER ONE
GENERAL INTRODUCTION
Research works and experiments have convinced security experts that Network Intrusion Detection Systems (NIDS) alone are not capable of securing the computer networks from internal and external threats completely. (Renuka et al., 2011). An intrusion detection system (IDS) is a device or software application that monitors systems for malicious activities and policy violations and produces reports to a management station. Intrusion detection systems are primarily focused on identifying possible incidents, logging information about them and reporting attempts. Organizations use these systems for identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. The goals of intrusion detection systems are to use all available information in order to detect both attacks by external hackers and misuse by insiders. IDSs are based on the belief that an attacker’s behaviour will be noticeably different from that of a legitimate user. (tzeyoung, 2009).
Intrusions can occur due to vulnerabilities in operating systems. Many common operating systems are simply not designed to operate securely. Thus, malware often is written to exploit discovered vulnerabilities in popular operating systems. Depending on the nature of the attack, many times if an operating system is compromised, it can be difficult for an IDS to recognise that the operating system is no longer legitimate. Operating Systems must be designed to better support security policies pertaining to authentication, access control and encryption. Intrusion detection uses vulnerability assessment (sometimes referred to as scanning), which is a technology developed to access the security of a computer system or network. Hackers can use malware to record keyboard strokes, then send that account and password information by hacking sites which store those details through the use of tools such as scanning tools; which they use to survey and analyse system characteristics and remote management tools; used by system’s administrators to manage a network by managing and controlling systems devices from a remote location.
According to the Information Assurance Technology Analysis Center (IATAC), 2009; IDSs are generally made up of sensors, analysers, user interfaces and honeypot. Sensors are deployed in a network or on a device to collect data, they take input from various sources, including network packets, log files and system call traces. Analysers in an IDS collect data forwarded by sensors and then determine if an intrusion has actually occurred. The user interface of the IDS gives the end user a view and way to interact with the system. Through the interface, a user can control and configure the system. Honeypot is a fully deployed IDS which administrators deploy as a bait or decoy for intruders, it can be used as early warning systems of an attack, decoys from critical systems and data collection sources for attack analysis.
Provos and Holz (2007), defined honeypot as ‘A closely monitored computing resource that we want to be probed, attacked or compromised.’ The value of a honeypot is weighed by the information that can be obtained from it. To detect malicious behaviour, a network intrusion detection system (NIDS) requires signatures of known attacks and often fail to detect compromises that were unknown at the time it was deployed. Also NIDSs produces erroneous results called false positives and false negatives, which occur when the NIDS erroneously detects a problem with benign traffic and when unwanted traffic is undetected by the NIDS respectively. On the other hand, honeypots can detect vulnerabilities that are not yet understood. For instance, a compromise can be detected by observing network traffic leaving the honeypot, even if the means of the exploit has never been seen before. Honeypots consists of unreal services such as mail, telnet, HTTP etc, database for logging, packet dispatcher and protocols such as ICMP, TCP and UDP.
Related Project Materials
QUANTIFYING INCREMENTAL OILPRODUCTION AND ECONOMICS OF USING INTELLIGENT COMPLETION AS A TOOL FOR RESERVOIR MANAGEMENT
ABSTRACT
Huge amount of hydrocarbon in place is left unrecovered. Integrated reservoir management, inaddition to the u...
FINANCIAL RECORD KEEPING AND CHALLENGES IN MICRO FINANCE BANKS
EXCERPT FROM THE STUDY
Account means a formal banking relationship established to provide or engage in services, dealing...
MICROBIAL BURDEN AND ANTIMICROBIAL SUSCEPTIBILITY OF ISOLATES FROM BEAN CAKES SOLD IN MINNA METROPOLIS, NIGERIA
ABSTRACT
Bean cakes are ready-to-eat deep-fried cowpea paste. It is commonly known as àkàrà (in Yoruba language) or...
INFLUENCE OF SOCIAL STUDIES TEACHERS’ PROFESSIONAL TRAINING ON JUNIOR SECONDARY SCHOOL STUDENTS’ PERFORMANCE IN KADUNA STATE, NIGERIA
Background to the Study
Education is an important instrument for achieving national development. It is through the process of education t...
SME FINANCING AND ECONOMIC GROWTH IN NIGERIA
Abstract
This research work examined the effect of SME financing and economic growth in Nigeria. The research was d...
APPRAISAL OF METHOD OF TEACHING BUSINESS STUDIES IN SECONDARY SCHOOL
BACKGROUND OF THE STUDY
Business Education programs are part of the total educational program in Nigeri...
THE PROSPECT AND CHALLENGES OF DATA ANALYTICS IN FORENSIC ACCOUNTING INVESTIGATIONS
Abstract: THE PROSPECT AND CHALLENGES OF DATA ANALYTICS IN FORENSIC ACCOUNTING INVESTIGATIONS
This research explores the prospects and ch...
THE EFFECT OF CORRUPTION ON EFFECTIVE SERVICE DELIVERY SYSTEM IN AN ORGANIZATION
ABSTRACT
This research is aimed at finding the effect of corruption on effective service delivery in the public sector u...
CHALLENGES OF POOR DRAINAGE SYSTEMS AND FLOODS CONTROL IN LAGOS METROPOLIS, NIGERIA
Abstract
Flooding is persistent in Lagos Metropolis. The objective of this study is to ascertain the causes, magnitude,...
IMPLEMENTATION OF STUDY PLANNING APPLICATION FOR BAZE UNIVERSITY
ABSTRACT
This is an application that aids any person (students or otherwise) learn new skills and build proper study habits by automating...
