Network Security Monitoring System via Android Mobile App With IDS

Developments in information and communication technology which are increasing rapidly, it is also required to improve the quality of security. The increase of internet usage has led to high number of intrusions or attacks that exploit weaknesses in internet protocols, operating systems and application software. Due to the high number of attacks, information technology security is an important thing to consider in an organization or individual. One solution that can be applied to overcome this problem is to monitor network security. One of the implementations of network security monitoring is the implementation of an Intrusion Detection System (IDS). The purpose of this research was to design a Snort-based network security monitoring system as a tool for implementing IDS to detect attacks by sending notifications via Telegram Bot which is integrated with the server owned by Unit Sumber Daya Informasi Universitas Udayana using the Network Development Life Cycle (NDLC) method. Based on the configuration results of research conducted on the Unit Sumber Daya Informasi Universitas Udayana server, there was the lowest data on May 16, 2023 with 64,418 data and the highest data on April 04, 2023 with 261,672 data and 2 Nmap Scan attack data as the lowest type of attack and 13,703 DDoS attack data as the highest type of attack.

IDS (Intrusion Detection System) plays a vital role in network security in that it monitors system activities to identity unauthorized use, misuse or abuse of computer and network system. For the simulation of IDS a model has been constructed based on the DEVS (Discrete EVent system Specification) formalism. With this model we can simulate whether the intrusion detection, which is a core function of IDS, is effectively done under various different conditions. As intrusions become more sophisticated, it is beyond the scope of any one IDS to deal with them. Thus we placed multiple IDS agents in the network where the information helpful for detecting the intrusions is shared among these agents to cope effectively with attackers. Each agent cooperates through the BBA (Black Board Architecture) for detecting intrusions. If an agent detects intrusions, it transfers attacker's information to a Firewall. Using this mechanism attacker's packets detected by IDS can be prevented from damaging the network.

Attack-aware Security Function Management

The IEEE 802.11 wireless networks are organized either in infrastructure mode or ad-hoc mode. These wireless networks are very common, because of their portability and ease of access. In infrastructure mode of wireless networks, wireless clients have to be aware of the environments due to vulnerability and various types of attacks that can made by wireless intruders. Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) security protocols are used to protect any wireless infrastructure against wireless intruders. The main problem of wireless network is to maintain the network security. Firewalls are not much capable to secure network from attacks because firewall can only detect the attacks which come from outside of the network. Therefore, Intrusion Detection System (IDS) plays an important role in network security. In general Intrusion Detection System (IDS) is used to detect unauthorized access, malicious access point and various types of wireless attacks in IEEE 802.11 infrastructure mode of wireless networks. Network based Wireless Intrusion Detection system (WIDS) is designed to detect Denial of Service (DOS) attack and Malicious Access Point (Evil Twin Attack) in Wi-Fi networks. Because DOS attack and Evil Twin Attack are the most significant attacks in IEEE 802.11 networks. In this work, a diverse detection algorithm is proposed to detect DOS attack and Evil Twin Attack which is based on number of deauthentication frames and beacon frames and some other fields. In this project, an experimental setup for wireless network infrastructure with one access point (AP) and three or four number of wireless clients are used to design Wireless Intrusion Detection System (WIDS). In that design, one client act as an attacker and another one client act as detector. In this work, Kali Linux based attack software tool is used to register wireless clients to launch attacks on the network. The set of commends are used to configure on the designed infrastructure wireless networks for testing the attacks and solutions

The network security is getting more important due to the wide-spread computer viruses and increasing network attacks. Nowadays, more and more security mechanisms, such as firewalls and intrusion detection systems (IDS), are introduced to protect the network from malicious attacks. This paper proposes an agent and service based intrusion detection and response system for active network. In contrast to a traditional passive network, an active network gives the nodes programmable ability to exercise various active network technologies. The intrusion response, service deployment, and service update mechanisms are centered on this technology. The proposed model of intrusion detection and response system (IDRS) catches network attacks and responses to stop the attacks at the first time to reduce the damage. Detecting, reporting, and responding capabilities are all embedded and integrated in the proposed system. A prototype system is developed using a novel data mining technology (the support vector machine) to enhance the detection function. In addition, several experiments were conducted to verify the system and results showed that the system was able to effectively identify the intrusions and respond promptly. Experiments also showed that the support vector machine outperforms the competitive neural networks in identifying the intrusions.

Port scanning is a first common discovering step which allows cyber malicious actors to gather valuable information about target hosts namely defense, governmental and banks servers by trying to identify instantly open ports, which correspond to specific services on the cloud, such as HTTP, DNS, and email. This paper aims to introduce a detection and evaluation approach for port scanning attacks in various contexts and levels of criticity based on fuzzy reasoning method. A new fuzzy logic controller, which uses fuzzy rules base and the Mamdani inference method is proposed as Intrusion Detection System as a Service, which dynamically detect and evaluate the criticity of port scanning. This SaaS enables network administrators and cyber security specialists to follow in real time the network traffic behavior, i.e., the Port Scanning Criticity Level (PSCL). A Dynamic dashboard is implemented to quickly and efficiently identify malicious port scanning activities. Experimentations and evaluations showed the efficiency of the proposed system in multilevel port scanning detection compared to Snort and the related IDS systems.

Computer networks are built to achieve the main goal of communicating with each other . During the transmission process, it is expected that information can be conveyed quickly, efficiently and safely. Network security serves to avoid damage or even data loss caused by attacker activities during the communication process. Security aspects that need to be maintained in data information are Confidentiality, Integrity and Availability. Intrusion Prevention System is a solution that can maintain network security from various attacks. The Intrusion Prevention System will act as a protector on the network by detecting and preventing suspicious traffic on nodes in a network. The Intrusion Prevention System in its implementation has several tools which are used in this study, namely Snort and IPTables. Testing is done by performing attacks on the Web Server. The attacks carried out are Port Scanning, DDoS attacks and Brute Force. The results of this study are based on the CIA Triad with the three attacks having different characteristics in terms of cause and effect. On the defense side, Port Scanning and Brute Force can be easily prevented by IPS, but in DDoS attacks there are differences in results between drop and reject rule. In a DDoS attack with an action drop rule, it can recover the web server in 160 seconds while the action reject rule can be restored at 145 seconds which normally can be recovered in a DDoS attack in 165 seconds. The IPS server can also reduce resources when there is a DDoS attack by 9.2% .

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The intrusion detection system (IDS) deals with huge amount of data which contains irrelevant and redundant features causing slow training and testing process, higher resource consumption as well as poor detection rate. To overcome these limitations, we introduce the concept of lightweight IDS. The lightweight IDSs are small, powerful, and flexible enough to be used as permanent elements of the network security infrastructure. In this paper, we propose a novel concept for building lightweight IDS based on two different approaches. The first approach is using a features selection approach by applying fuzzy enhanced support vector decision function (Fuzzy ESVDF) algorithm. This approach is able to improve system efficiency. The second approach is using IDS classification scheme. The IDS classification scheme divides the detection process into four types according to the TCP/IP network model (application layer IDS, transport layer IDS, network layer IDS, and link layer IDS). This IDS classification scheme enhances an organizationpsilas ability to detect most types of attack (improving system accuracy and generality). Also, it improves IDS scalability and extendibility. To design the proposed system, several experiments have been conducted, and they indicate that the proposed lightweight IDS can deliver satisfactory system performance.

В статье представлено развитие сигнатурного подхода обнаружения вторжений на основе кластеризации и дерева решений. Также предложен оригинальный способ разработки аномального подхода к обнаружению вторжений, разработана модель функционирования гибридной системы обнаружения вторжений, отличающаяся от известных большей точностью обнаружения, меньшим процентом ложных тревог, приоритезацией сетевых пакетов для анализа, а также решающей основные недостатки аномального и сигнатурного подхода. Introduction: Alongside the development of the Internet, network security has become a crucial requirement. Bugs in software and operating systems result in an increasing number of previously unknown intrusions discovered every day. The harm caused by these intrusions is becoming more and more dangerous. Firewalls can't ensure a complete protection of the network, because they prevent external threats and don't maintain internal attacks. Intrusion detection systems (IDS) solve this problem. The aim of the research is to develop a model of a hybrid intrusion detection system that will use a combination of improved detection methods based on anomalous and signature approach to increase detection accuracy and reduce the level of false alarms. Tasks: development of an improvement for the signature detection method, development of a unique anomaly detection method, development of a unique hybrid model of the intrusion detection system. Methods. To improve the signature detection method, we used machine learning, in particular the C5 algorithm, as well as decision trees. In addition to this, there are presented: storing signature rules with their partial structure in the MongoDB database, the process of clustering rules, building and detecting with the use of a decision tree. There are presented a unique method for detecting anomalies in network traffic with the use of machine learning methods and the theory of finite automata. Besides, there are shown: the detection process with the use of the sliding window technique, machine learning and time automaton; storage of trained models in the MongoDB database, the process of loading anomalies into the signature database with the use of RabbitMQ. Findings. The hybrid IDS with increased detection accuracy and reduced false alarm rate was developed. The developed system was compared with the well-known open-source solutions Snort and Suricata. The signature detection method was improved with machine learning and decision trees, and a unique anomaly detection method that uses machine learning and a time automaton was presented. It allows to detect previously unknown attacks. The practical significance of the work is the partial implementation of the developed system for the Infologistik24 LLC company.

The Network Security Monitoring System (NSMS) can use Big Data (BD) and K-means DT (K-means with distance threshold) algorithms to automatically learn and identify abnormal patterns in the network, improving the accuracy of network threat detection. In this article, KDD Cup 1999 and NSL KDD were selected as NSMS for dataset analysis. Preprocess the data; Extract statistical information, time series information, and traffic distribution characteristics. Value device DT further classifies regular attacks, remote location (R2L) attacks, and user to root (U2R) permission attacks. The experimental results show that the hybrid intrusion detection algorithm based on K-means DT achieves a network attack detection accuracy of 99.2% and a network attack detection accuracy of 98.9% on the NSL-KDD dataset. Hybrid intrusion detection algorithms can effectively improve the accuracy of network intrusion detection (NID). The hybrid intrusion detection system proposed in this article performs well on different datasets and can effectively detect various types of network intrusion attacks, with better performance than other algorithms. The NSMS designed in this article can cope with constantly changing network threats.

The problem of the network security is taken up since eighties (Denning et al., 1987) and is developed up today (Beltilch et al., 2004, Bera, 2010, Dasgupta, 1999, Basile, 2007, Wilson, 1999). A major problem of automatic intrusion detection is that, it is difficult to make a difference between normal and abnormal user behaviour. Intrusion detection system should not only recognise the previously known patterns of attacks, but also react in case of appearance of the new events that violate the network security policy. The distributed nature of the task of the network security monitoring requires applying of the distributed tools for network security maintaining. The most important postulate addressed to the intrusion detection systems is that, such systems should automatically react in case of detecting the security policy breach to prevent the attack execution or to reduce the potential loss in the network systems. Intrusion detection systems should be equipped with the components responsible for the permanent observation of the states of monitored nodes and components that integrate the results of these observations and diagnose the security level of the system (Kolaczek et al., 2005, Nguyen et al., 2006). A comprehensive survey of anomaly detection systems is presented in (Patcha & Park, 2007) and a comparison of different approaches to intrusion detection systems is given in (Bejtlich, 2004). One of the first agent systems for network security monitoring has been proposed in works (Balasubramaniyet et al., 1998, Spafford & Zamboni, 2000). In work (Kolaczek et al., 2005) a framework of an original proposal of the intrusion detection system based on the multi-agent approach was presented. In particular, the architecture of such a system and the task of agents were specified. Proposed ideas were further developed and in work (Nguyen et al., 2006) the problem of anomalies detection on the basis of the nodes traffic analysis was discussed. The proposal of the method for Denial of Service Attack detection was given in (Prusiewicz, 2008a). In this work we propose a novel framework of a multi-agent system for anomaly detection. The originality of our solution consists of applying the social network approach to Man in the Middle Attack (MITM) detection in a network system. Our proposal is based on the social networks discovery and their characteristics measurement to detect anomalies in network traffic. We assume that network communication between nodes constitutes social network of users and their applications, so the appropriate methods of social network formal analysis can be applied. The other important assumption is that values of these social

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

With the rapid development of machine learning and Internet technology, the combination of the two methods is well appreciated recently.An anomaly and intrusion detection system is a mechanism that monitors network or system activities for malicious activities.Intrusion detection and prevention systems are primarily focused on identifying possible incidents, logging information about them and reporting attempts.As far as other usages of Intrusion detection and prevention systems are concerned, such as identifying problems with security policies and deterring individuals from violating security policies.Anomaly detection systems are becoming an important addition to the security infrastructure of nearly every organization.In this paper, we propose a novel mechanism for real-world traffic and research there cases with theoretical analysis.

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.