Battling Against Intrusion and Behavior Based Healing System on Real Time Traffic Using Ourmon and Wireshark
Keywords:
IDS, Wireshark, AnomaliesAbstract
Intrusion Detection System (IDS) has been utilized as a key instrument as a part of shielding the system from this malevolent action. With the capacity to break down system activity and perceive approaching and on-going network attack, majority of system executive has swing to IDS to help them in identifying irregularities in system movement. The gathering of information and analysis on the anomalies activity can be classified into fast and slow attack. Since fast attack activity make a connection in few second and uses a large amount of packet, detecting this early connection provide the administrator one step ahead in deflecting further damages towards the network infrastructure. This paper describes IDS that detects fast attack intrusion using time based detection method. The time based detection method calculates the statistic of the frequency event using Wire shark which occurs between one second time intervals for each connection made to a host thus providing the crucial information in detecting attack.
References
- Haitao Sun, Shengli Liu, JiayongChen and Changhe Zhang “HTTP tunnel Trojan detection based on network behavior”, Elsevier, Proceedings to the Energy Procedia ESEP 2011: 9-10 December 2011, Singapore, pp. 1272 – 1281, 2011.
- Borders K and Prakash A. Web tap:detecting covert web traffic. Proc. ACM conference on Computer and Communications Security (CCS 04)2014;110-120.
- Kruegel C, Vigna G. Anomaly Detection of web-based attacks. Proc. ACM conference on Computer and Communications Security (CCS 03)2013;251-261.
- Wenke Lee. (2010). A Data Mining Framework for Constructing Feature and Model for Intrusion Detection System. PhD thesis University of Columbia.
- Cuppen, F. & Miege, A. (2012). Alert Correlation in a Cooperative Intrusion Detection Framewok. In Proceeding of the 2002 IEEE Symposium on Security and Privacy. IEEE, 2002.
- Cabrera, J.B.D., Ravichandran, B & Mehra R.K. (2014). Statistical Traffic Modelling for Network Intrusion Detection. In Proceeding of the IEEE Conference.
- Yeophantong, T, Pakdeepinit, P., Moemeng, P & Daengdej, J. (2015). Network Traffic Classification Using Dynamic State Classifier. In Proceeding of IEEE Conference.
- Farah J., Mantaceur Z. & Mohamed BA. (2007). A Framework for an Adaptive Intrusion Detection System using Bayesion Network. Proceeding of the Intelligence and Security Informatics, IEEE, 2007.
- Wang Y., Huang GX. & Peng DG. (2006). Model of Network Intrusion Detection System Based on BP Algorithm. Proceeding of IEEE Conference on Industrial Electronics and Applications, IEEE, 2006.
- Sekar, R., Gupta, A., Frullo, J., Shanbhag, T., Tiwari, A., Yang, H. & Zhou, S. (2010). Spesification-based Anomaly Detection: A New Approach for Detecting Network Intrusions. In Proceeding of CCS ACM Conference.
- Karl Levitt. (2012). Intrusion Detection: Current Capabilities and Future Direction. Proceeding of IEEE Conference of the 18th Annual Computer Security Application, IEEE, 2012.
- Garuba, M., Liu, C. & Fraites, D. (2008). Intrusion Techniques: Comparative Study of Network Intrusion Detection Systems. In Proceeding of Fifth International Conference on Information Technology: New Generation, IEEE, 2008.
- Robertson S., Siegel EV., Miller M. & Stolfo SJ. (2003). Surveillance
- Detection in High Bandwidth Environment. In Proceeding of IEEE Conference on the DARPA information Survivability and Exposition, IEEE, 2013.
Downloads
Published
Issue
Section
License
Copyright (c) IJSRSET
This work is licensed under a Creative Commons Attribution 4.0 International License.