Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am starting my final year project and I have decided to make an Intrusion Detection System, but I am a little confused where to start. I have read some papers and those have been pointing out the different features (like distributive nature of IDS etc.) instead of pointing out a real start. I just want to know from where I could start and what platform would be suitable for the same...

share|improve this question

3 Answers 3

up vote 2 down vote accepted

If you are reading academic papers, then it is likely you are going to be reading about esoteric features, distributed problems, and otherwise interesting OPEN issues in the ongoing battle of IDS.

If you are looking for (a) specific paper(s), then I would suggest looking for a SURVEY of existing systems. Surveys usually give some historical review with emphasis on the current state of the art. They are generally easy to read and light on hard-core analysis. I googled for "survey of intrusion detection systems" and got so many viable hits I won't even bother linking to any of them. You can try to focus purely on academia by hitting the major academic CS research websites such as CiteSeerX.

Since this is a term project, the nature of the system needs to be scalable. Don't try to go all out -- maybe try creating a host-based IDS instead of trying to tackle otherwise more difficult issues. You may also want to focus on something easy like a signature-based approach rather than a heuristic-based approach. Remember: the core problem you are trying to solve is that of Intrusion Detection, rather than, say, distributed systems.

Of course if you find yourself with more time on your hands at the end, then augment. Software development is an evolutionary process. Start with something simple and build out.

share|improve this answer
    
What are the recent trends in IDS anyway??? –  Pankaj Anand Jan 17 '12 at 12:27

For an interesting look into a "research" IDS, you could also look at Bro. The website also has a lot of interesting documentation and links to papers and research topics.

share|improve this answer
    
While Bro used to be a "reasearch" NIDS in the early days, it is now a production-grade NIDS. Particularly the 2.0 release has significantly improved user friendliness. Many researchers still use it as a network research building block due to its robust TCP stream reassembler and its matured protocol analyzers. To better understand the NIDS architecture, I recommend reading the original Bro paper and the NIDS cluster paper. –  Matthias Vallentin Mar 23 '12 at 16:01

The Snort forums would be an excellent place to gain information. They are focused on the snort engine, but much of the discussion which isn't around configuring snort should be applicable to many IDS implementations.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.