Testing of IDS model using several intrusion detection tools

Abstract

Abstract. The aim of this work is to provide set of selected tests on IDS model that would enlarge the functionality of intrusion detection systems. Designed model is using several IDS, which allows it to investigate larger bandwidth and capture more attacks. This system consists of central master node and devices on which the intrusion detection systems are.The tests were designed with the attribute of repeatability and universality. They are divided into five categories which explore specific attributes of intrusion detection system.

Reducing Time-Related Demands of Flow-Based Network Monitoring Tools Emerging during Data Processing

“…DATA ANALYSIS AND VISUALIZATION Monitoring and analyzing the network traffic based on the IPFIX protocol [3], as depicted in Fig. 1, can be split into the following steps:…”

“…Nowadays, the most commonly used data measurement methods are based on collecting information about the network and its traffic at the level of flows. Network monitoring by flow-level based measurement platformseither implementing the NetFlow v9 [2] or IPFIX [3] protocolsis based on the analysis of information obtained from traffic properties and characteristics. These properties (e.g.…”

“…the total number of bytes of all packets belonging to a certain flow) and characteristics (e.g. source IP address) of the flow are carried in flow records [2], [3]. The export of flow records represents a push-based mechanism, where the data are transmitted from the exporter(s) to the collector(s) over either the TCP, UDP or the SCTP protocols [2], [3].…”

“…source IP address) of the flow are carried in flow records [2], [3]. The export of flow records represents a push-based mechanism, where the data are transmitted from the exporter(s) to the collector(s) over either the TCP, UDP or the SCTP protocols [2], [3]. Further important tasks, as described above, are data processing, analysis, evaluation and visualization, which most commonly take place in an analyzing application (analyzer).…”

Between syntax and semantics of resource oriented logic for IDS behavior description

“…The Snort is a type of IDS [3], where intrusion detection is based on known algorithms and attack pattern, i.e. signatures.…”