Implementation of an IDS

Question

I am starting my final year project and I have decided to make an Intrusion Detection System, but I am a little confused where to start. I have read some papers and those have been pointing out the different features (like distributive nature of IDS etc.) instead of pointing out a real start. I just want to know from where I could start and what platform would be suitable for the same...

Answer 1

If you are reading academic papers, then it is likely you are going to be reading about esoteric features, distributed problems, and otherwise interesting OPEN issues in the ongoing battle of IDS.

If you are looking for (a) specific paper(s), then I would suggest looking for a SURVEY of existing systems. Surveys usually give some historical review with emphasis on the current state of the art. They are generally easy to read and light on hard-core analysis. I googled for "survey of intrusion detection systems" and got so many viable hits I won't even bother linking to any of them. You can try to focus purely on academia by hitting the major academic CS research websites such as CiteSeerX.

Since this is a term project, the nature of the system needs to be scalable. Don't try to go all out -- maybe try creating a host-based IDS instead of trying to tackle otherwise more difficult issues. You may also want to focus on something easy like a signature-based approach rather than a heuristic-based approach. Remember: the core problem you are trying to solve is that of Intrusion Detection, rather than, say, distributed systems.

Of course if you find yourself with more time on your hands at the end, then augment. Software development is an evolutionary process. Start with something simple and build out.

Answer 2

For an interesting look into a "research" IDS, you could also look at Bro. The website also has a lot of interesting documentation and links to papers and research topics.

Answer 3

The Snort forums would be an excellent place to gain information. They are focused on the snort engine, but much of the discussion which isn't around configuring snort should be applicable to many IDS implementations.