Architecture for Real Time Monitoring and Modeling of Network Behavior for Enhanced Security

Abstract

Network security is a rapidly growing and is the major area of concern for every network. Firewalls are used as a security check point in network environment even then different types of security issues keep on emerging. In order to protect the network from illegal access, the concept of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) is been developed. An IDS is a system where the events occurring in a network is monitored and analyzed for identifying the sign of possible incidents. These incidents may either be violations or the threats that are about to happen violating the computer security policies or standard security policies. Java programming language is made use for developing the Intrusion Detection System. JPCap package is used along with winpcap for developing the traffic monitoring system. The network packets are captured online i.e., as they come across the interface of the network. The IDS is aimed to provide the preliminary level of detection techniques so as to secure the systems present in the networks.

Real-Time Monitoring of Network Devices: Its Effectiveness in Enhancing Network Security

“…According to a study by Ambika and Nataraj (2013) on architecture for real-time modelling and monitoring of network behaviour to enhance network security, it was found that the rise in the need for network security has led to the development and application of Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) in network systems to prevent illegal access. An IDS is a system that facilitates monitoring and analysis of events taking place in a network system to identify the signs of possible incidents.…”

A Mobile Multi-Agent-Based Conceptual Architecture for the Intelligent Monitoring of Computer Networks

“…Available monitoring architecture cannot ensure the comprehensiveness of the monitoring data to identify and evaluate all possible problems that could occur in a CN because these architectures are intended to monitor certain aspects of CN performance (e.g., security, productivity, etc.) [3,4] and a specific CN component (e.g., network equipment, network traffic, network services and users).…”